# GitHub Actions: Claude in issues and pull requests

Course: Claude Code: Pro Level — https://zero2vibecode.com/learn/claude-code-pro
Canonical URL: https://zero2vibecode.com/learn/claude-code-pro/3-3-github-actions
Verified against: Claude Code v2.1.292 (2026-10-15)
Last updated: 2026-10-22

The official action runs Claude Code as a CI step. Without a prompt it answers when someone mentions @claude in an issue or pull request; with a prompt it works on its own. Limits, token permissions and the time cap live right in the workflow file.

Claude Code can work right inside a GitHub repository: answer in issues, review pull requests, carry out tasks on a schedule. For that there is an official action — `anthropics/claude-code-action`.

## Two modes

- **Without a `prompt`** the action waits for someone to mention `@claude` in an issue or pull request, and answers with a comment. For example, you open an issue "@claude, what does src/links.js do? Do not change anything" — and Claude replies in it.
- **With a `prompt`** the action carries out the given task on its own, without a mention — on a schedule, for example.

## Quick setup

Inside a session in your repository:

```
/install-github-app
```

Claude Code installs the GitHub App, saves the credentials as a repository secret — `ANTHROPIC_API_KEY` or `CLAUDE_CODE_OAUTH_TOKEN` — and opens a pull request with a ready workflow file. When GitHub asks which repositories to give access to, choose **Only select repositories** and only the one you need.

## Limits go in the file

Nobody is at the keyboard, so the limits are written right into the workflow. The skeleton looks like this (take the exact list of permissions and inputs from the file the quick setup generated):

```yaml
name: Claude
jobs:
  claude:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@v4
      - uses: anthropics/claude-code-action@v1
        with:
          claude_args: "--max-turns 5"
```

- `claude_args` passes Claude Code flags — `--max-turns`, `--allowedTools` and the others from earlier lessons;
- `permissions` trims the GitHub token's rights for this job;
- `timeout-minutes` caps the run time.

If the prompt is written as plain text rather than through a skill, Claude has no shell access until you explicitly allow the commands it needs.

## The cost

Every run spends GitHub Actions minutes — in a private repository, from your account's allowance — and tokens: billed to the API key, or taken from your plan if it is a subscription token. `--max-turns` and `timeout-minutes` cap both.

**Careful.** 
The @v1 tag moves to every new release of the action, and each release pins its own Claude Code version — your workflow can suddenly start running on a version you never checked. GitHub says it plainly: only pinning to a full commit SHA gives you an immutable release. A lighter compromise is a specific release tag instead of @v1.

**Practice in the terminal.** Build the .github/workflows/claude.yml skeleton line by line with echo in single quotes: name, jobs, timeout-minutes and a uses: anthropics/claude-code-action step. The first line goes in with >, the rest with >>.