ES · Leer en español Explore for free

Recipe · Intermediate · 15 min

Review every pull request with Claude Code in GitHub Actions

Set up anthropics/claude-code-action@v1 to review your PRs on its own, answer @claude in comments and keep costs in check. Ready-to-use workflows.

Tested with Claude Code 2.1.316 · reviewed

The problem

Reviewing every pull request by hand takes time, and on small teams PRs get approved without anyone reading them closely. You want Claude Code to leave comments on the PR as soon as it opens, and to ask it questions with @claude without leaving GitHub. And you don't want it to burn your Actions minutes or API balance on every README change.

The solution

Two workflows using the official anthropics/claude-code-action action (tag @v1; the latest release as of Oct 31, 2026 is v1.0.266): one reviews every PR automatically, the other answers when someone writes @claude. You need admin access to the repository.

Tested: YAML syntax and configuration (every input in the step exists in the action's current action.yml). Not tested: running it on GitHub; that depends on your repository, your installed app and your secret.

1. Install the app and the secret (quick setup)

Install the GitHub CLI and sign in. Then, inside your repository:

gh auth login
claude

In Claude Code type /install-github-app and follow the prompts. It installs the Claude GitHub App, saves your credential as a repository secret (ANTHROPIC_API_KEY for an API key, CLAUDE_CODE_OAUTH_TOKEN for your subscription) and opens a pull request with the workflows. It only works with github.com repositories.

2. Or do it by hand

  1. Install the Claude GitHub App on the repository.
  2. Create the secret under Settings → Secrets and variables → Actions → New repository secret:
    • ANTHROPIC_API_KEY: a key from the Claude Console.
    • or CLAUDE_CODE_OAUTH_TOKEN: a token from your subscription (Pro, Max, Ultra, Team or Enterprise). Generate it on your machine:
claude setup-token
  1. Copy the two workflows from steps 3 and 4 into .github/workflows/.

If you use the OAuth token, in both files replace the line anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }} with claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}.

3. Automatic review of every PR

Save this as .github/workflows/claude-code-review.yml. It uses the official code-review plugin (the same one quick setup installs) and adds cost control: it ignores docs-only changes, skips drafts, cancels the previous review when a new commit arrives, and caps turns and minutes.

name: Claude Code Review

on:
  pull_request:
    types: [opened, synchronize, ready_for_review, reopened]
    paths-ignore:
      - "**/*.md"
      - "docs/**"

concurrency:
  group: claude-review-${{ github.event.pull_request.number }}
  cancel-in-progress: true

jobs:
  review:
    if: github.event.pull_request.draft == false
    runs-on: ubuntu-latest
    timeout-minutes: 15
    permissions:
      contents: read
      pull-requests: read
      issues: read
      id-token: write
    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 1
      - uses: anthropics/claude-code-action@v1
        with:
          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
          plugin_marketplaces: "https://github.com/anthropics/claude-plugins-official.git"
          plugins: "code-review@claude-plugins-official"
          prompt: "/code-review:code-review --comment ${{ github.repository }}/pull/${{ github.event.pull_request.number }}"
          claude_args: |
            --max-turns 20
            --allowedTools "mcp__github_inline_comment__create_inline_comment"

What each piece does:

4. Answering @claude in comments

Save this as .github/workflows/claude.yml:

name: Claude Code

on:
  issue_comment:
    types: [created]
  pull_request_review_comment:
    types: [created]

concurrency:
  group: claude-${{ github.event.issue.number || github.event.pull_request.number }}
  cancel-in-progress: false

jobs:
  claude:
    if: contains(github.event.comment.body, '@claude')
    runs-on: ubuntu-latest
    timeout-minutes: 20
    permissions:
      contents: write
      pull-requests: write
      issues: write
      id-token: write
      actions: read
    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 1
      - uses: anthropics/claude-code-action@v1
        with:
          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
          claude_args: "--max-turns 10"

This workflow does request write access (contents, pull-requests, issues) because Claude can commit and open PRs when you ask. If you only want the automatic review, don't add this file. actions: read lets it read the PR's CI results.

5. Push the files

git add .github/workflows/claude-code-review.yml .github/workflows/claude.yml
git commit -m "ci: PR review with Claude Code"
git push

pull_request workflows run with the file from the PR's branch; comment workflows run with the one from the default branch. Merge into main first so @claude works across the whole repository.

Check it

Before pushing, validate the syntax on your machine (if you have Python with PyYAML):

python3 -c "import yaml,glob; [yaml.safe_load(open(f)) for f in glob.glob('.github/workflows/claude*.yml')]; print('YAML OK')"

Expected output: YAML OK.

On GitHub:

  1. Open a PR that touches code (not only .md). The Claude Code Review run appears in the Actions tab.
  2. When it finishes (a few minutes), the PR shows inline comments on each issue it found, or a single summary comment if it found none. The author is the Claude GitHub App.
  3. Write in a PR comment: @claude what are the risks of this change?. A Claude Code run starts in Actions and a reply appears on the same PR, updating as it works.
  4. Push again to the PR: the previous in-progress review is cancelled and a new one starts.

Why it works

The action picks its mode from your configuration: without prompt it runs in interactive mode (it waits for the @claude phrase and replies in a comment); with prompt it runs in automation mode (it runs on every event). Before starting, it checks that whoever triggered the run has write access to the repository and isn't a bot, so outsiders can't spend your balance and loops are avoided. Everything in claude_args is a regular Claude Code CLI argument. Sources: Claude Code GitHub Actions, the action's README and the full list of inputs.

Common mistakes

FAQ

How much does it cost?

You pay GitHub Actions minutes and API tokens depending on the PR size. With CLAUDE_CODE_OAUTH_TOKEN, usage counts against your Claude subscription instead of API billing.

API key or OAuth token?

For a personal repository, the claude setup-token token is convenient. For an organization sharing the secret, the docs recommend an API key, because the token is tied to the subscription of whoever generated it.

Can Claude merge my PRs?

Not with these workflows: the review only has read permissions and comments through the app. The @claude one can commit if you ask; always review its changes before merging.

How do I tell it what to review?

Put your rules (style, review criteria, project rules) in a CLAUDE.md at the repository root; Claude reads it on every run. Keep it short: it costs tokens every time.

What if I don't want to maintain a workflow?

Anthropic offers Code Review, which reviews every PR without a workflow file.

All recipes