Cc Actions

Claude Code GitHub Actions

Configure automation using anthropics/claude-code-action with event routing, subagents, hooks, and MCP integration.

Quick Start

name: Claude Code
on:
  issue_comment: { types: [created] }
  pull_request: { types: [opened, synchronize] }
  issues: { types: [opened, labeled] }

permissions:
  contents: write
  pull-requests: write
  issues: write

jobs:
  claude:
    if: github.actor != 'github-actions[bot]'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: anthropics/claude-code-action@v1
        with:
          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}

Core Concepts

Key Patterns

Event Routing

jobs:
  pr-comment:
    if: github.event_name == 'issue_comment' && github.event.issue.pull_request
  issue-comment:
    if: github.event_name == 'issue_comment' && !github.event.issue.pull_request
  label-triggered:
    if: contains(github.event.issue.labels.*.name, 'claude-implement')

Subagents

prompt: |
  Delegate to 3 parallel subagents:
  1. Security Agent: OWASP Top 10, auth checks
  2. Performance Agent: N+1 queries, memory leaks
  3. Style Agent: Naming, documentation, tests

Hooks

{
  "hooks": {
    "PostToolUse": [{
      "matcher": "Edit|Write",
      "hooks": [{ "type": "command", "command": "npx prettier --write $(jq -r '.tool_input.file_path')" }]
    }],
    "Stop": [{
      "hooks": [{ "type": "command", "command": "npm run lint && npm test" }]
    }]
  }
}

Performance

concurrency:
  group: claude-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

on:
  pull_request:
    paths: ['src/**', '!**/*.md']

Tuning Reference

Critical Gotchas

1. --allowedTools vs --disallowedTools

   • allowedTools only skips prompts—does NOT restrict tools
   • Use disallowedTools to actually block: --disallowedTools Bash,Run,Edit

2. MCP + Subagents

   • MCP tools do NOT work in background subagents
   • Always run MCP operations in foreground

3. Fork Safety

   • pull_request event = safe (read-only token, no secrets)
   • pull_request_target = dangerous if you checkout fork code
   • Never: checkout ref: ${{ github.event.pull_request.head.sha }} with secrets

4. Hook Exit Codes

   • 0 = continue
   • 2 = block, feed stderr to Claude
   • Other = log error, don't block

5. Subagent Limits

   • ~10 concurrent subagents max
   • Additional tasks queue

Examples

See examples/ for 14 production-ready use cases:

Patterns

• Event Routing - Conditions, label routing, author associations
• Subagents - Creation, parallel execution, built-in types
• Hooks - All events, exit codes, JSON parsing, examples
• Permissions - Tool control layers, known issues
• Security - Fork handling, external contributors, safe patterns
• Reusable Workflows - workflow_call, composite actions
• Performance - Concurrency, caching, path filtering
• Skills - Domain expertise, skill structure, hooks

Official Docs

Synced from anthropics/claude-code-action:

• Configuration - MCP servers, settings, custom tools
• Security - API key protection, commit signing
• Usage - Inputs, outputs, migration guide