Claude Code in GitHub Actions: @claude mentions, setup and costs

With the Claude Code GitHub Action you can write @claude in an issue or pull request comment and have Claude read the code, make a change and push it. It can also run a prompt on a schedule or on any GitHub event. Here is how to set it up, what it costs, who can trigger it and what to check when it stays silent.

What this is (and what it isn't)

Several products share the Claude Code name. This guide is about the claude-code-action workflow integration, which you configure with workflow files in your repository. As we read the docs, these are separate things: Code Review (automatic review of every pull request without writing a workflow), Claude Code in the cloud (sessions on cloud machines) and the Agent SDK (custom automation outside GitHub Actions, which this action is built on). GitLab has its own CI/CD page.

Set it up

Either way you need admin access to the repository.

• Quick setup. In the repository, open claude and run /install-github-app. It only works with github.com repositories, and it expects the GitHub CLI installed and signed in with gh auth login. It installs the Claude GitHub App, stores your credential as a repository secret, pushes a branch with the workflow files you pick and opens a pull request. Merge that pull request and @claude works. If you stop partway with Esc, the closing message lists what already happened.
• Manual setup. Install the Claude GitHub App on the repository, add the secret yourself, and copy the official claude.yml from the action's examples folder into .github/workflows/. The docs call it a working workflow, not just a sample. Use this path if you don't run Claude Code locally, the command fails, or you want full control.

The credential

• Add one of two repository secrets: ANTHROPIC_API_KEY (an API key from the Claude Console) or CLAUDE_CODE_OAUTH_TOKEN (a token for your Claude subscription on Pro, Max, Team or Enterprise, made by running claude setup-token locally).
• In the workflow, pass the secret to the matching input: anthropic_api_key or claude_code_oauth_token.
• Never commit a key or token to the repository. Store it as a GitHub Secret and reference it from the workflow, and give the workflow only the permissions it needs.
• For a secret shared across many repositories, the docs recommend an API key rather than an OAuth token, because an OAuth token is tied to the subscription of whoever generated it.

Using it

Comment on an issue or pull request, for example @claude fix the TypeError in the user dashboard component. Claude replies in a comment and updates it as it works. It also reacts to a review comment, a pull request review, or the title or body of a newly opened issue.

• Interactive mode: your workflow has no prompt input, so Claude waits for the trigger phrase, @claude by default.
• Automation mode: your workflow gives a prompt, so Claude runs without waiting for a mention, for example on a schedule. By default the result goes to the workflow run log rather than a comment, unless the prompt tells Claude to post and it has a way to.

For a project's own rules, put them in CLAUDE.md in the repository root: Claude follows it when it opens pull requests (see CLAUDE.md and memory).

Who can trigger it

• The person who comments needs write access to the repository. There is an allowed_non_write_users input for exceptions, which also needs your own github_token. Events with no human author, such as a schedule, skip this check.
• Bots are rejected unless you list them in allowed_bots, to stop bots from triggering Claude in a loop. A scheduled run is attributed to a repository user, usually whoever last changed the cron line, so if that user is a bot, list it.

What it costs

Each run uses two things: GitHub Actions minutes on the hosted runner, and tokens (or your subscription's usage, if you authenticate with the OAuth token). The docs suggest ways to cap both:

• Write specific @claude requests, and use issue templates to give context up front.
• Keep CLAUDE.md short, since it is read on every run.
• Set --max-turns in claude_args to limit iterations.
• Use workflow-level timeouts and GitHub's concurrency controls to avoid runaway or parallel jobs.

More general ways to spend less are in reduce token usage.

When it doesn't answer

• No reply to @claude: check that the app is installed on the repository, that workflows are enabled, that the secret exists, that the comment contains @claude as a whole word (not /claude or @claude-bot), and that the commenter has write access.
• Your CI doesn't run on Claude's commits: GitHub doesn't start workflows for commits made with the default GITHUB_TOKEN. If you pass that token to the action, remove it so the action authenticates as the Claude GitHub App, and check your CI triggers include the events Claude's pushes produce.
• Authentication errors: test the key or token locally with claude before debugging the workflow.

Using a cloud provider, and uninstalling

Amazon Bedrock, Google Cloud's Agent Platform and Microsoft Foundry are supported through inputs such as use_bedrock, with OIDC federation instead of a stored API key. To remove everything: delete the workflow files (claude.yml and, if you picked it, claude-code-review.yml), delete the secret from the repository and any organization secrets, and uninstall the GitHub App only if no other Claude feature uses it. Deleting a secret does not revoke the credential, so retire an API key in the Console as well.

All the guides are in the guides index. If you also want Claude on a schedule from your own machine, see running Claude Code from a script and the permissions starter. This follows Anthropic's GitHub Actions documentation as we read it in October 2026, shortened on purpose. We are not affiliated with Anthropic or GitHub. We wrote this from the documentation and have not tested every setup. Input names, versions and defaults change, and where this page and the documentation disagree, the documentation wins. Never paste a real key into a prompt, an issue or a file in the repository.

The free loop-stop skill gives long tasks a limit and a stop rule. If you want a second pair of eyes on your CLAUDE.md and settings, the Tune-Up Kit is a checklist for exactly that.