The Claude Code GitHub Action runs Claude Code inside your workflows so an at-claude mention in an issue or pull request can analyze code or push commits. Set it up with the secret stored as a repository secret, a workflow that grants only the permissions it needs, and turn limits so a run cannot sprawl.
Setup paths
Per Anthropic's GitHub Actions documentation, quick setup is running /install-github-app from Claude Code, which installs the app, saves the secret and opens a pull request with the workflow. It needs admin access to the repository, works only with github.com repositories, and requires the GitHub CLI. Manual setup means installing the app, adding a secret, and copying the example workflow.
The secret is either ANTHROPIC_API_KEY or CLAUDE_CODE_OAUTH_TOKEN. For a secret shared across repositories, the docs recommend an API key rather than an OAuth token, since the token is tied to the subscription of whoever generated it. They also describe workload identity federation, which exchanges the GitHub OIDC token so no long-lived secret is stored.
Checklist
- Store credentials only as GitHub secrets. The page warns never to commit keys or tokens.
- Review the app permissions. The official app has a single permission set shared by several features, including Actions, Contents, Issues, Pull requests and Workflows with write access in places. GitHub does not let you accept a subset. If you want only what the action uses, the docs describe a custom app with Contents, Issues and Pull requests.
- Set workflow permissions per job. A review job can use read permissions for contents and pull requests, as in the docs example.
- Know who can trigger runs. The action requires write access for the triggering user on issue and pull request events, and rejects bot actors unless you list them in an allowed bots input.
- Remember fork behavior. On public repositories, GitHub withholds secrets from fork pull request runs, so a review workflow runs only for same-repository branches.
- Restrict tools. With a plain text prompt, Claude has no shell or API access until you grant tools in
claude_args. - Cap work with a max turns setting, workflow timeouts and concurrency controls.
- Put review rules in CLAUDE.md, and keep it short, since it is read on every run.
Why triggers deserve attention
Anyone who can get text into an issue or comment that Claude reads can try to steer it. The write access check is a real control, so avoid loosening it with the non-write users input unless you accept the exposure. Also note that commits made with the default workflow token do not trigger further workflows, which is a GitHub behavior the docs call out in troubleshooting.
Cost
Each run uses runner minutes and API tokens. A scheduled workflow fires regardless of activity, and GitHub disables schedules in public repositories after 60 days without activity.
Quick check
Who can trigger the action by commenting?
Users with write access to the repository, by default. Bots are rejected unless listed.
Why recommend an API key over an OAuth token for org-wide use?
The OAuth token is tied to the subscription of the person who ran the setup command.
Sources
Last reviewed: 19 October 2026.
