Claude Code in CI/CD: GitHub Actions & GitLab

Why run Claude Code in CI

Traditional CI validates code mechanically — it compiles, lints, and runs tests. Claude Code in CI adds a layer of semantic understanding on top of that: it reasons about why a change is risky, not just whether it parses.

Mechanical CI

Build and compile checks
Lint and format gates
Pass/fail test suites
Coverage thresholds

Claude Code in CI

Deep semantic PR review
Triage issues into actionable tasks
Generate tests for uncovered code
Update docs and i18n strings when APIs change
Write migration scripts on schema changes

In short, it extends CI from validating what you wrote to actively assisting with development. This page is part of the broader Claude Code tutorial series.

GitHub Actions: quick setup

Drop this workflow into your repo. It reviews every pull request automatically and listens for @claude mentions in comments.

yaml

# .github/workflows/claude-review.yml
name: Claude Code Review
on:
  pull_request:
    types: [opened, synchronize]
  issue_comment:
    types: [created]

jobs:
  claude-review:
    if: |
      github.event_name == 'pull_request' ||
      contains(github.event.comment.body, '@claude')
    runs-on: ubuntu-latest
    permissions:
      contents: write
      pull-requests: write
      issues: write
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - uses: anthropics/claude-code-action@v1
        with:
          anthropic_api_key: $

What this gives you:

Every PR triggers an automatic code review
Anyone can comment @claude fix the type errors in this PR
Claude commits its fixes directly onto the PR branch

@claude trigger patterns

Once the action is installed, you direct Claude in plain English from PR and issue comments. Treat it like a teammate you can @-mention.

text

# In GitHub PR comments:
@claude review this PR for security vulnerabilities
@claude write unit tests for the new functions in this PR
@claude the CI is failing because of TypeScript errors — fix them
@claude update the changelog and bump the patch version
@claude this needs to support ESM imports — update accordingly

# In GitHub Issues:
@claude this issue has been sitting for 3 months — can you implement it?
@claude create a PR with a fix for this bug

Advanced GitHub Actions patterns

Schedule nightly reviews, inject a CI-specific CLAUDE.md, or route through Amazon Bedrock and Google Vertex AI for enterprise model hosting.

yaml

# Scheduled nightly review
on:
  schedule:
    - cron: '0 2 * * *'  # 2 AM daily

# With custom CLAUDE.md for CI context
- uses: anthropics/claude-code-action@v1
  with:
    anthropic_api_key: $
    claude_md_content: |
      # CI Review Agent
      You are reviewing a pull request. Focus on: correctness, test coverage,
      security vulnerabilities, and performance regressions. Do not suggest
      stylistic changes. Always run the test suite before approving.

# Using with Amazon Bedrock
- uses: anthropics/claude-code-action@v1
  with:
    use_bedrock: true
  env:
    AWS_REGION: us-east-1
    AWS_ROLE_ARN: $
    ANTHROPIC_MODEL: claude-sonnet-4-6-20251101

# Using with Google Vertex AI
- uses: anthropics/claude-code-action@v1
  with:
    use_vertex: true
  env:
    ANTHROPIC_VERTEX_PROJECT_ID: $
    CLOUD_ML_REGION: us-east5

GitLab CI/CD

On GitLab there's no dedicated action — you install the CLI in a job and run it non-interactively with claude -p. The same patterns apply: review merge requests, or turn an issue into an MR on a trigger.

yaml

# .gitlab-ci.yml
claude-mr-review:
  image: node:20
  script:
    - npm install -g @anthropic-ai/claude-code
    - claude -p "Review this merge request for quality and security" --no-interactive
  rules:
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'

# With OIDC authentication (recommended for production)
variables:
  ANTHROPIC_API_KEY: $ANTHROPIC_API_KEY

claude-issue-to-mr:
  script:
    - |
      ISSUE_TITLE=$(gitlab api /projects/$CI_PROJECT_ID/issues/$ISSUE_IID | jq -r .title)
      claude -p "Implement: $ISSUE_TITLE — create a branch and MR" --no-interactive
  rules:
    - if: '$CI_PIPELINE_SOURCE == "trigger" && $ISSUE_IID != ""'

Security considerations in CI

Claude in CI can commit and open PRs autonomously, so the blast radius matters. Lock it down before you scale up, and apply the same discipline when you move work into production deployment patterns.

Never use bypassPermissions in CI without an explicit, documented need.
Scope the ANTHROPIC_API_KEY secret to the minimum required permissions.
Use protected branches to control which Claude commits land where.
Review Claude's CI commits before auto-merging — gate with required approvals.
For Bedrock/Vertex, authenticate with OIDC rather than long-lived credentials.

Notes

Token cost scales with PR size

Full-repo reviews on every synchronize event burn tokens fast on large monorepos. Scope prompts to changed files, cap fetch-depth thoughtfully, and consider nightly batch reviews instead of per-push on busy branches.

Write permissions are a real blast radius

The action needs contents: write to commit fixes onto PR branches. Use branch protection, required reviewers, and never auto-merge Claude commits on main without human approval.

Fork PRs need extra workflow guards

Workflows triggered from fork comments can expose secrets if pull_request_target is misconfigured. Restrict @claude handlers to trusted collaborators or use explicit if: conditions on actor and event type.

CI CLAUDE.md should differ from local

Inject a CI-specific constitution via claude_md_content — focus on security and correctness, not style nits. Your local CLAUDE.md may encourage exploration; CI agents should be conservative and test-driven.

Quick summary

Claude in CI turns mechanical validation into intelligent review, triage, and fixes
The anthropics/claude-code-action@v1 action wires up auto-review and @claude mentions in minutes
GitLab uses the CLI in non-interactive mode; Bedrock and Vertex cover enterprise hosting
Scope secrets tightly, protect branches, and require approvals before auto-merge

CI/CD FAQ

How do I run Claude Code in GitHub Actions?

Drop a workflow file into .github/workflows that uses the anthropics/claude-code-action@v1 action and passes your ANTHROPIC_API_KEY secret. It reviews every pull request automatically and listens for @claude mentions in comments.

How do I automate pull request review with Claude Code?

Configure the GitHub Actions workflow to trigger on pull_request events of type opened and synchronize, so every PR gets an automatic semantic code review. Claude reasons about why a change is risky, not just whether it compiles, and can commit fixes directly onto the PR branch.

Does Claude Code support GitLab CI/CD pipelines?

Yes. GitLab has no dedicated action, so you install the CLI in a job with npm install -g @anthropic-ai/claude-code and run it non-interactively using claude -p. The same patterns apply: review merge requests or turn an issue into an MR on a trigger.

What secrets and authentication does Claude Code in CI need?

At minimum you provide an ANTHROPIC_API_KEY secret scoped to the minimum required permissions. For enterprise model hosting you can route through Amazon Bedrock or Google Vertex AI, and for those you should authenticate with OIDC rather than long-lived credentials.

How do I run Claude Code non-interactively in a pipeline?

Use the claude -p command with the --no-interactive flag inside a CI job, passing the task as a prompt such as reviewing a merge request for quality and security. This headless mode lets Claude run on triggers like merge_request_event without any manual input.