Claude Code GitHub Action: type @claude in a PR to review, fix bugs, answer questions

Picture this: in a PR you comment “@claude fix the TypeError in the dashboard component”, and a few minutes later Claude has pushed a fix to that same branch. Or every new PR gets an automatic review against your team’s checklist, with inline comments on each problem line. That’s Claude Code GitHub Actions — the anthropics/claude-code-action action running Claude Code inside your repository’s workflows.

Two modes

Setup

Quick setup

Install the GitHub CLI and sign in (gh auth login), open claude in the repo and run:

/install-github-app

Claude Code installs the Claude GitHub App, stores the auth secret (ANTHROPIC_API_KEY for an API key, or CLAUDE_CODE_OAUTH_TOKEN for a subscription), pushes a branch with the workflow files and opens a ready PR — you just merge it. Repo admin rights are required; only github.com repositories are supported.

Manual setup

1. Install the Claude GitHub App on the repo.
2. Add the ANTHROPIC_API_KEY secret (a Claude Console key), or CLAUDE_CODE_OAUTH_TOKEN (generated with claude setup-token, for Pro/Max/Team/Enterprise plans).
3. Copy the action repo’s examples/claude.yml into .github/workflows/.

Minimal workflow: respond to @claude

name: Claude Code
on:
  issue_comment:
    types: [created]
  pull_request_review_comment:
    types: [created]
jobs:
  claude:
    if: contains(github.event.comment.body, '@claude')
    runs-on: ubuntu-latest
    permissions:
      contents: write
      pull-requests: write
      issues: write
      id-token: write      # needed for default GitHub App authentication
      actions: read        # lets Claude read CI results on PRs
    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 1
      - uses: anthropics/claude-code-action@v1
        with:
          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}

Once merged, try comments such as @claude explain why this test is flaky or @claude implement this feature from the issue description.

Automatic review on every PR

name: Code Review
on:
  pull_request:
    types: [opened, synchronize, ready_for_review, reopened]
jobs:
  review:
    runs-on: ubuntu-latest
    permissions: { contents: read, pull-requests: read, issues: read, id-token: write }
    steps:
      - uses: actions/checkout@v6
        with: { fetch-depth: 1 }
      - uses: anthropics/claude-code-action@v1
        with:
          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
          plugin_marketplaces: "https://github.com/anthropics/claude-code.git"
          plugins: "code-review@claude-code-plugins"
          prompt: "/code-review:code-review --comment ${{ github.repository }}/pull/${{ github.event.pull_request.number }}"
          claude_args: '--allowedTools "mcp__github_inline_comment__create_inline_comment"'

The --comment flag makes Claude post its review on the PR (inline comments, or one summary comment if it finds nothing). Claude skips drafts, closed PRs, trivial/automated PRs, and PRs it has already commented on.

Running on a schedule

on:
  schedule:
    - cron: "0 9 * * *"     # 09:00 UTC daily
...
      - uses: anthropics/claude-code-action@v1
        with:
          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
          prompt: "Summarise yesterday's commits and open issues"
          claude_args: |
            --allowedTools "mcp__github__list_commits,mcp__github__list_issues"

In automation mode with a plain prompt, Claude has no shell or GitHub API access until you grant tools via --allowedTools. GitHub only runs scheduled workflows from the default branch and, on public repos, disables schedules after 60 days without activity.

Common inputs

Who can trigger runs?

• On issue/PR events, the triggering user needs write access (you can widen this with allowed_non_write_users).
• Bots are rejected unless listed in allowed_bots — preventing bot-triggers-bot loops.
• On public repos, GitHub withholds secrets from fork-PR runs, so automatic reviews only run on same-repo branches.

Cost and safety

• Each run consumes GitHub Actions minutes and API tokens (or subscription usage with an OAuth token).
• Lower costs with specific requests, a concise CLAUDE.md (read on every run), --max-turns, workflow timeouts and concurrency limits.
• Never commit keys — always use GitHub Secrets; grant workflows minimal permissions; always review Claude’s changes before merging.
• Organisations that don’t want long-lived secrets can use workload identity federation (OIDC) with a Claude Console service account.

How to apply it

• Developers: Start with @claude mode — it only runs when called, so costs stay predictable. Use it for code questions and small fixes.
• Tech Leads: Put your review checklist in CLAUDE.md and enable automatic review for internal-branch PRs. Watch the first week’s cost, then tune --max-turns.
• PMs: A 9 am scheduled workflow summarising yesterday’s commits and issues — an automatic report, with nobody compiling it by hand.