The Complete Guide to Claude Code CI/CD Integration: From Local Dev to Automated Pipelines

# Analyze a file
claude -p "Analyze src/utils.ts for code quality issues"
 
# Pipe input
cat src/utils.ts | claude -p "Review this code"
 
# Analyze git diff
git diff main | claude -p "Review these changes, point out potential issues"

claude -p --output-format json "Analyze src/utils.ts for code quality"

{
  "result": "Analysis result text...",
  "is_error": false,
  "total_cost_usd": 0.023,
  "session_id": "abc123"
}

# Read-only mode: only allow reading and searching, no file modifications
claude -p --allowedTools "Read,Grep,Glob" "Review all API endpoint security in src/"

# .github/workflows/claude-review.yml
name: Claude Code Review
 
on:
  pull_request:
    types: [opened, synchronize]
 
jobs:
  review:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: write
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
 
      - uses: anthropics/claude-code-action@v1
        with:
          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
          prompt: |
            Review this PR's code changes. Focus on:
            1. Potential bugs and logic errors
            2. Security vulnerabilities
            3. Performance issues
            4. Code style consistency

name: Claude Code Review
 
on:
  pull_request:
    types: [opened, synchronize]
    paths:
      - 'src/**'
      - 'lib/**'
      - 'app/**'
 
jobs:
  review:
    runs-on: ubuntu-latest
    # Skip draft PRs and bot-created PRs
    if: |
      github.event.pull_request.draft == false &&
      github.event.pull_request.user.login != 'dependabot[bot]'
    permissions:
      contents: read
      pull-requests: write
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
 
      - uses: anthropics/claude-code-action@v1
        with:
          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
          model: claude-sonnet-4-6
          max_turns: 10
          prompt: |
            You are a strict but friendly code reviewer. Review all changes in this PR.
 
            Review focus:
            1. **Correctness**: Logic errors, edge cases, null handling
            2. **Security**: Injection vulnerabilities, sensitive data leaks, permission issues
            3. **Performance**: Unnecessary loops, memory leaks, N+1 queries
            4. **Maintainability**: Naming clarity, function complexity, code duplication
 
            Output format:
            - 🔴 Must fix: Blocking issues
            - 🟡 Suggestion: Improvement recommendations
            - 🟢 Well done: Things worth praising
 
            If no issues found, just say "LGTM" — don't manufacture problems.

name: Claude Auto Fix
 
on:
  issue_comment:
    types: [created]
 
jobs:
  auto-fix:
    # Only trigger on PR comments containing /claude-fix
    if: |
      github.event.issue.pull_request &&
      contains(github.event.comment.body, '/claude-fix')
    runs-on: ubuntu-latest
    permissions:
      contents: write
      pull-requests: write
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ github.event.issue.pull_request.head.ref }}
          fetch-depth: 0
 
      - uses: anthropics/claude-code-action@v1
        with:
          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
          max_turns: 20
          allowed_tools: "Read,Grep,Glob,Edit,Write,Bash"
          prompt: |
            Read all review comments on this PR and fix the mentioned issues.
            After fixing, commit the changes.
            Commit message format: fix: <brief description of the fix>

name: Claude Issue to PR
 
on:
  issues:
    types: [labeled]
 
jobs:
  implement:
    # Only trigger when the "claude" label is added
    if: github.event.label.name == 'claude'
    runs-on: ubuntu-latest
    permissions:
      contents: write
      pull-requests: write
      issues: write
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
 
      - uses: anthropics/claude-code-action@v1
        with:
          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
          max_turns: 30
          prompt: |
            Read Issue #${{ github.event.issue.number }}.
            Based on the issue description:
            1. Create a new branch: claude/issue-${{ github.event.issue.number }}
            2. Implement the feature or fix described in the issue
            3. Ensure code passes lint and tests
            4. Create a PR with the title referencing the issue number
            5. Explain the implementation approach in the PR description
 
            Follow the coding standards in the project's CLAUDE.md.

# .gitlab-ci.yml
claude-review:
  stage: review
  image: node:20
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
  before_script:
    - npm install -g @anthropic-ai/claude-code
  script:
    - |
      git diff origin/$CI_MERGE_REQUEST_TARGET_BRANCH_NAME...HEAD > /tmp/diff.txt
      REVIEW=$(claude -p --output-format text --max-turns 10 \
        --allowedTools "Read,Grep,Glob" \
        "Review the following code changes, point out potential issues: $(cat /tmp/diff.txt)")
      echo "$REVIEW"
      # Post review as MR comment
      curl --request POST \
        --header "PRIVATE-TOKEN: ${GITLAB_TOKEN}" \
        --header "Content-Type: application/json" \
        --data "{\"body\": \"## Claude Code Review\n\n${REVIEW}\"}" \
        "${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/merge_requests/${CI_MERGE_REQUEST_IID}/notes"
  variables:
    ANTHROPIC_API_KEY: $ANTHROPIC_API_KEY

#!/bin/bash
# scripts/claude-review.sh
 
set -euo pipefail
 
# 1. Get changes
DIFF=$(git diff origin/main...HEAD)
 
if [ -z "$DIFF" ]; then
  echo "No code changes, skipping review"
  exit 0
fi
 
# 2. Claude Code review
REVIEW=$(echo "$DIFF" | claude -p \
  --output-format text \
  --max-turns 10 \
  --allowedTools "Read,Grep,Glob" \
  "Review these code changes. Focus on bugs, security vulnerabilities, and performance issues. If no issues found, reply LGTM.")
 
# 3. Output result
echo "$REVIEW"
 
# 4. Check for blocking issues (optional)
if echo "$REVIEW" | grep -q "🔴"; then
  echo "::error::Claude Code found blocking issues"
  exit 1
fi

# Jenkins, CircleCI, Azure DevOps, etc.
- run: bash scripts/claude-review.sh
  env:
    ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}

# .claude/Dockerfile
FROM node:20-slim
RUN npm install -g @anthropic-ai/claude-code
ENTRYPOINT ["claude"]

# Use in CI
steps:
  - run: |
      docker build -t claude-code -f .claude/Dockerfile .
      git diff main | docker run -i \
        -e ANTHROPIC_API_KEY=${{ secrets.ANTHROPIC_API_KEY }} \
        claude-code -p --max-turns 10 "Review these changes"

# Read-only review (safest)
- uses: anthropics/claude-code-action@v1
  with:
    allowed_tools: "Read,Grep,Glob"
    prompt: "Review code changes"
 
# Can fix (needs write permissions)
- uses: anthropics/claude-code-action@v1
  with:
    allowed_tools: "Read,Grep,Glob,Edit,Write"
    disallowed_tools: "Bash"
    prompt: "Fix lint errors"
 
# Full permissions (use with caution)
- uses: anthropics/claude-code-action@v1
  with:
    disallowed_tools: "WebFetch,WebSearch"
    prompt: "Implement this feature"

# Don't concatenate user input directly into prompts
# ❌ Dangerous
prompt: "Review this PR: ${{ github.event.pull_request.title }}"
 
# ✅ Safe: let Claude Code read PR info itself
prompt: "Review the current PR's code changes, focus on security and correctness"

# Choose model based on task
- uses: anthropics/claude-code-action@v1
  with:
    model: claude-sonnet-4-6  # Sonnet for code review
    max_turns: 10
 
# Haiku for simple tasks
- uses: anthropics/claude-code-action@v1
  with:
    model: claude-haiku-4-5
    max_turns: 5

on:
  pull_request:
    types: [opened, synchronize]
    paths:
      # Only review source code changes, ignore docs and config
      - 'src/**'
      - 'lib/**'
      - 'app/**'
      - '!**/*.md'
      - '!**/*.mdx'
 
jobs:
  review:
    # Skip draft PRs
    if: github.event.pull_request.draft == false
    # Skip bot PRs
    if: github.event.pull_request.user.login != 'dependabot[bot]'

# Use JSON output to get cost info
- name: Claude Review
  id: review
  run: |
    RESULT=$(claude -p --output-format json --max-turns 10 "Review code changes")
    COST=$(echo "$RESULT" | jq -r '.total_cost_usd')
    echo "cost=$COST" >> $GITHUB_OUTPUT
    echo "Claude Code review cost: \$$COST"
 
# Set up cost alerts
- name: Cost Alert
  if: steps.review.outputs.cost > 1.0
  run: echo "::warning::Claude Code single review cost exceeded $1.0"

# CLAUDE.md
 
## CI/CD Rules
 
When running in CI (CI=true environment variable detected):
 
### Code Review
- Only focus on files changed in this PR, do not review unmodified code
- Categorize findings: 🔴 Must fix, 🟡 Suggestion, 🟢 Well done
- If no issues found, just reply "LGTM" — do not manufacture problems
- Do not suggest refactoring unmodified code
 
### Auto-Fix
- Only fix clear issues (lint errors, type errors), do not refactor opportunistically
- Run relevant tests after each fix to confirm nothing breaks
- Commit message format: fix: <brief description>
 
### Security
- Never include environment variable values in output
- Do not read .env files
- Do not make network requests

# .github/workflows/claude-pr-pipeline.yml
name: Claude PR Pipeline
 
on:
  pull_request:
    types: [opened, synchronize]
    paths:
      - 'src/**'
      - 'lib/**'
      - 'app/**'
  issue_comment:
    types: [created]
 
jobs:
  # Job 1: Auto review
  review:
    if: |
      github.event_name == 'pull_request' &&
      github.event.pull_request.draft == false
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: write
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
 
      - uses: anthropics/claude-code-action@v1
        with:
          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
          model: claude-sonnet-4-6
          max_turns: 10
          allowed_tools: "Read,Grep,Glob"
          timeout_minutes: 10
          prompt: |
            Review this PR's code changes.
 
            Review focus:
            1. Correctness: Logic errors, edge cases, null handling
            2. Security: Injection vulnerabilities, sensitive data leaks
            3. Performance: Unnecessary loops, memory leaks
            4. Maintainability: Naming, complexity, duplication
 
            Output format:
            - 🔴 Must fix (with specific file and line number)
            - 🟡 Suggestion
            - 🟢 Well done
 
            No issues? Just say LGTM.
 
  # Job 2: Auto fix (comment-triggered)
  auto-fix:
    if: |
      github.event_name == 'issue_comment' &&
      github.event.issue.pull_request &&
      contains(github.event.comment.body, '/claude-fix')
    runs-on: ubuntu-latest
    permissions:
      contents: write
      pull-requests: write
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ github.event.issue.pull_request.head.ref }}
          fetch-depth: 0
 
      - uses: anthropics/claude-code-action@v1
        with:
          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
          model: claude-sonnet-4-6
          max_turns: 20
          allowed_tools: "Read,Grep,Glob,Edit,Write,Bash"
          disallowed_tools: "WebFetch,WebSearch"
          prompt: |
            Read all review comments on this PR and fix the mentioned issues.
            After fixing:
            1. Run lint to confirm it passes
            2. Run tests to confirm nothing is broken
            3. Commit changes with format: fix: <description>