CClaude Code Guide中文

Claude Code in CI/CD

CI/CD integration is useful when Claude Code should react to pull requests, failing checks, issue reports, or review tasks. Automation should be scoped and auditable.

Last verified
Applies to
Claude Code 2.1.x. CLI spellings were checked on local version 2.1.198; current official docs may describe newer 2.1.x behavior.
Verification method
Official documentation, CLI reference, and changelog reviewed on 2026-07-19. GitHub App, action, permissions, and provider paths are documentation-based. No repository app, secret, or workflow was installed during this audit.
Official sources
GitHub ActionsCLI referenceChangelog

Reproducible practice

Pilot Claude review on a non-production pull request

Introduce the GitHub integration with explicit permissions, a harmless test PR, observable logs, and a complete removal path.

Prerequisites

  • Repository-admin approval and a disposable or non-production repository.
  • Direct Claude API access for the /install-github-app quickstart, or the documented Bedrock/Google Cloud path.
  • A secret-management and branch-protection policy agreed before installation.

Steps

  1. Record the intended access

    The official app requests read/write access to Contents, Issues, and Pull requests. Decide whether that is acceptable before installation.

  2. Run the official guided installer

    Use an interactive local session; never paste an API key into source or a prompt.

    Step 2
    claude
/install-github-app

  3. Review generated repository changes

    Inspect workflow triggers, action version, permissions, secret names, and allowed tools before merging.

  4. Exercise a harmless PR

    Use a documentation-only change, invoke the configured trigger, and observe the Actions run, comment, and requested permissions.

Expected result

A test workflow runs only on intended events, obtains credentials from GitHub secrets or OIDC, and produces an auditable PR result without bypassing branch protection.

Validation

  • Inspect the workflow run logs and exact commit SHA.
  • Confirm required checks and human review still gate protected branches.
  • Check repository App permissions and secret names after installation.

Failure handling

Installer unavailable

Confirm direct API eligibility and admin rights, then use the official manual or cloud-provider instructions.

Workflow has no permission

Compare job permissions, App installation scope, fork policy, and secret availability; do not make the token globally broader.

Cleanup or rollback

  • Disable or remove the workflow, delete its repository secret, and uninstall or restrict the GitHub App.
  • Close the pilot PR and verify no scheduled or comment trigger remains active.

Boundaries and when not to use it

  • This audit does not prove a live GitHub installation; the page labels the integration flow as documentation-based.
  • Automation should not push directly to protected branches or replace test and human review ownership.

Pull request review

Automated review can look for correctness bugs, regressions, and security-sensitive changes. It should complement human review and test results, not replace ownership of the code.

Fixing failed checks

A CI workflow can pass logs and changed files to Claude Code so it can propose or apply targeted fixes. The best prompts identify the failing job, command, and expected outcome.

Issue triage

Claude Code can help summarize reports, find likely code areas, and draft reproduction steps. For production bugs, keep final triage tied to logs, tests, or observable behavior.

Automation boundaries

CI agents should have limited permissions, clear branch behavior, and review requirements. Avoid workflows that can silently modify protected branches or bypass normal checks.

Non-interactive CI query
claude -p "Review the changed files in this PR for regressions. Output findings only." \
  --allowedTools "Read" "Grep" "Bash(git diff *)"
Long-lived token setup
claude setup-token

GitHub Actions patterns

Common automation jobs include PR review, failing-check triage, and autofix workflows triggered by CI or reviewer comments.

PR review

Pass the diff, test status, and changed paths so Claude Code can comment on concrete risk rather than generic style.

Read guide

Failed CI triage

Include the failing job name, command, and log excerpt; ask for the smallest fix that restores the check.

Read guide

Comment-triggered task

After the official action is configured, mention @claude in an issue or PR comment to request a bounded task and review its workflow run.

Read guide

CI/CD checklist

Related topics

WorkflowsCode reviewAuthenticationTroubleshooting