Claude Code in CI/CD Pipelines

Your CI pipeline runs the same checks every time. It has no idea what changed.

Lint, test, build, deploy. Same gates, every PR. They don't understand context. They don't write helpful PR descriptions. They don't catch the logical bug that passed your type checker.

Claude Code in CI changes that. The -p flag runs it non-interactively in any pipeline. It reads your code, understands the diff, and does real work. Not just pass/fail.

# In a GitHub Actions step
claude -p "review the changes in this PR and post a summary"

The -p Flag: Non-Interactive Mode

The -p (pipe) flag makes CI integration possible. It tells Claude Code to run without prompts, read from stdin or arguments, and output results to stdout.

# Basic usage in CI
claude -p "describe what changed in this PR"

# Pipe input
git diff main...HEAD | claude -p "review this diff for bugs"

# With output format
claude -p --output-format json "list all TODO comments in src/"

No interactive UI and nobody to click Allow, so any tool that would normally ask is denied. Pre-approve what the job needs with --allowedTools (for example --allowedTools "Read,Bash(git diff *)"), and add --bare in CI so the run skips the repo's hooks, plugins and MCP servers.

GitHub Actions: The Starter Workflow

Here's a practical workflow that adds Claude Code to your PR process:

name: Claude Code Review
on:
  pull_request:
    types: [opened, synchronize]

jobs:
  review:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Install Claude Code
        run: npm install -g @anthropic-ai/claude-code

      - name: Review PR
        env:
          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
        run: |
          git diff origin/main...HEAD | claude -p \
            "Review this diff. Focus on bugs, security issues,
             and missing error handling. Be concise." \
            > review.md

          gh pr comment ${{ github.event.number }} --body-file review.md

That's it. Every PR now gets an intelligent review comment.

Practical CI Use Cases

Automated PR descriptions. Developers write bad PR descriptions (if they write them at all). Claude Code reads the diff and writes a real summary.

claude -p "write a PR description for these changes.
  Include: what changed, why, and what to test." \
  > pr-description.md

Changelog generation. Point Claude Code at your commits since the last release and get a human-readable changelog.

git log v1.2.0..HEAD --oneline | claude -p \
  "generate a changelog grouped by: Features, Fixes, Other"

Test generation. When new code lands without tests, generate them automatically.

claude -p "write tests for any functions in src/utils/
  that don't have corresponding test files"

# Runs when a PR opens
claude -p "summarize this PR"
claude -p "review for bugs and security"
claude -p "check for missing tests"
claude -p "generate tests for uncovered functions"

Cost Considerations

Running Claude Code in CI uses API tokens. Be intentional about it.

• Run on PR events only, not every push to every branch
• Use Haiku for simple tasks (PR descriptions, changelog): Haiku 5.5 ($0.10/$0.50 per million tokens for prompts up to 100K) costs a twentieth of Sonnet 5.5 ($2/$10), since $2 / $0.10 = 20
• Use Sonnet for code review: worth the cost for actual bug detection
• Set the effort level: claude -p --effort low for routine jobs; thinking bills as output tokens
• Cache aggressively: don't re-review unchanged files
• Cap the spend: --max-budget-usd 1.00 stops a run at a dollar limit, and --max-turns 10 stops it after ten agentic turns

A small PR review measured $0.01 to $0.02 on Haiku 5.5 (2026-10-08) and about $0.24 on Sonnet 5 (2026-09-27), and bigger diffs cost more. That's cheaper than one missed production bug.

Security Notes

Your CI environment needs an ANTHROPIC_API_KEY. Store it as a GitHub Actions secret. Never put it in your workflow file. Scope the API key to the minimum permissions needed.

Claude Code in CI runs with whatever file access the runner has. It can read your entire repo. If that's a concern, use a restricted checkout that only includes the relevant directories.

Here's the thing: Claude Code's output in CI is consistent but not guaranteed identical. Don't use it as a hard gate that fails the build. Use it as advisory. Post comments, flag concerns, suggest improvements. Keep humans in the approval loop.