Learn · Configuration & workflows · CCAR-F task 3.6

Claude Code in CI/CD

claude -p with pre-approved tools, JSON output and hard limits; an independent reviewer; and the GitHub Action that answers @claude.

Key ideas

-p / --print runs one prompt non-interactively: the basis of every CI integration.
--allowedTools plus --permission-mode dontAsk: only pre-approved tools run, everything else is denied.
--output-format json returns result, session_id and total_cost_usd; --json-schema fills structured_output.
Bound runs with --max-turns and --max-budget-usd.
Review with an independent instance, and pass prior findings so re-runs report only new issues.
anthropics/claude-code-action@v1 answers @claude mentions; store the key in secrets.ANTHROPIC_API_KEY.
Settings precedence: managed > --settings > settings.local.json > settings.json > ~/.claude; arrays merge.

Read-only tools, no prompts, bounded turns, machine-readable output. Add --append-system-prompt for CI-specific instructions.

Running Claude Code in CI without -p, so the job waits for interactive input.
Allowing broad tools in CI instead of only what the job needs.
Having the session that wrote the code also review it.
Re-running a review without prior findings, so the PR fills with duplicate comments.
Hard-coding the API key in the workflow instead of using secrets.ANTHROPIC_API_KEY.