Claude Code in CI: useful pull request automation without a blank cheque

Choose a narrow task

Start with summarising, classifying or commenting on a bounded change. Automatically writing and publishing code needs more permissions and stronger gates. Separate advice from mutation in different workflows.

Restrict who can trigger it

A public issue, comment or fork is untrusted input. Check actor, repository context and event type before credentials become available. Never let ticket text determine workflow permissions.

Grant minimum workflow permissions

Set token permissions explicitly per job and provide write access only where required. Prefer short-lived identity for cloud access and avoid durable secrets in broad environments.

Isolate untrusted code

Code from a fork can change scripts the runner executes. Do not run untrusted changes in a privileged context or casually combine external code with secrets and broad network access.

No. It can flag patterns and collect context, but owners remain accountable for intent, risk and merge.

Make output reviewable

Route changes through a branch or draft pull request, show commands that ran and retain required checks and approvals. The agent should never bypass branch protection.

Monitor cost and abuse

Limit duration, iterations and allowed models or tools. Log triggers and technical outcomes without sensitive prompts. Include shutdown and token revocation in the incident plan.

permissions: contents: read pull-requests: write

steps: - run: pnpm test

Make Claude Code in CI and pull requests verifiable

The decision review for Claude Code in CI and pull requests first focuses on one pull request workflow with minimum token permissions, bounded triggers and a review result without autonomous merge. Define the acceptable user outcome, essential inputs and authorised approver for Claude Code in CI and pull requests before the trial starts. Keep the first Claude Code in CI and pull requests trial small enough to separate causes from effects.

Build evidence for Claude Code in CI and pull requests around one realistic successful route and also simulate a write token exposed to untrusted code, prompt injection from the diff and sensitive values in CI logs. For every Claude Code in CI and pull requests check, record the expected outcome, visible evidence and recovery action when it fails. The final decision question for Claude Code in CI and pull requests is: “Can AI review replace human review?”

Claude Code in CI and pull requests: from trial to everyday operation

Assign Claude Code in CI and pull requests one operational owner, one subject reviewer and a clear fallback route. Treat the Claude Code in CI and pull requests checklist as separate evidenced steps, so punctuation or phrasing never becomes part of the process logic. Ask the relevant user to complete Claude Code in CI and pull requests without spoken help and record every point that still needs explanation or manual recovery.

Keep change rights, logging, support and review dates for Claude Code in CI and pull requests in one operating plan. Repeat the Claude Code in CI and pull requests trial after a change to source data, configuration, model, integration or user role. Expand Claude Code in CI and pull requests only when the team can also detect, contain and recover a write token exposed to untrusted code, prompt injection from the diff and sensitive values in CI logs.

Stop the Claude Code in CI and pull requests rollout while a write token exposed to untrusted code, prompt injection from the diff and sensitive values in CI logs is not reported visibly and recoverable by the assigned owner.