Claude Code GitHub Integration: Actions, Enterprise, and Repository Setup

Developers now commit code that is 42% AI-generated or assisted, according to Sonar's 2026 State of Code survey of more than 1,100 professionals. Yet 96% of those developers don't fully trust the output, and 38% say reviewing AI-written code takes more effort than reviewing code from human colleagues. That trust gap between generation speed and review confidence explains why GitHub integration for AI coding tools has become required infrastructure, not a convenience feature.

Claude Code's GitHub integration spans three surfaces, each targeting a different part of the development workflow:

• GitHub Actions: Run Claude Code inside CI/CD pipelines. Automate PR reviews, respond to @claude mentions in issues and comments, fix CI failures automatically, and run scheduled tasks. The official action at anthropics/claude-code-action@v1 is used by more than 17,000 repositories.
• GitHub Enterprise Server: Connect self-hosted GitHub instances to Claude Code for web sessions, automated code review, plugin marketplaces, and contribution metrics. Available for Team and Enterprise plans.
• Repository authentication: Link GitHub repositories to Claude Code cloud sessions through GitHub App installation or personal access tokens, giving Claude permission to clone, read, and push code.

Most existing guides cover only the open-source repository at github.com/anthropics/claude-code or just the Actions integration in isolation. This guide walks through the full surface, from a basic @claude workflow to an Enterprise Server deployment with custom GitHub Apps and cloud provider authentication.

The fast way to get started is through the built-in installer. Open Claude Code in your terminal and run:

/install-github-app

This command installs the Claude GitHub App on your repository and walks you through adding workflow files and the API key secret. You need to be a repository admin. The GitHub App requests read and write permissions for Contents, Issues, and Pull Requests. In Claude Code v2.1.187 and later, you can choose to skip the workflow setup step and return to it by running the command again.

If the installer fails or you prefer manual setup, follow these three steps:

1. Install the Claude GitHub App at github.com/apps/claude
2. Add your ANTHROPIC_API_KEY to your repository secrets under Settings > Secrets and variables > Actions
3. Copy the workflow file from the examples directory in anthropics/claude-code-action into your repository's .github/workflows/ folder

Here is the basic workflow that responds to @claude mentions:

name: Claude Code
on:
  issue_comment:
    types: [created]
  pull_request_review_comment:
    types: [created]
jobs:
  claude:
    runs-on: ubuntu-latest
    steps:
      - uses: anthropics/claude-code-action@v1
        with:
          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}

This workflow triggers whenever someone creates a comment on an issue or pull request. When the comment contains @claude, Claude reads the full context, analyzes the code, and responds directly in the thread.

For automated PR review on every push, add a pull_request trigger with the code-review plugin:

name: Code Review
on:
  pull_request:
    types: [opened, synchronize]
jobs:
  review:
    runs-on: ubuntu-latest
    steps:
      - uses: anthropics/claude-code-action@v1
        with:
          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
          prompt: "/code-review:code-review"
          plugin_marketplaces: "https://github.com/anthropics/claude-code.git"
          plugins: "code-review@claude-code-plugins"

The v1 action uses auto-detection to determine whether to run in interactive mode (responding to mentions) or automation mode (running immediately with a prompt). You no longer need to specify a mode parameter, which was required in the beta version.

Key action parameters include:

• prompt: Instructions for Claude, either plain text or a skill name like /code-review
• claude_args: CLI arguments passed through to Claude Code, such as --max-turns 5 or --model claude-sonnet-4-6
• trigger_phrase: Custom trigger word, defaults to @claude
• anthropic_api_key: Your Claude API key from repository secrets

Test your setup by tagging @claude in an issue or PR comment. Claude should respond within a minute or two, depending on the complexity of the request and your runner availability.

Claude Code GitHub Actions supports multiple authentication methods so you can match your organization's security requirements without workarounds.

Direct API key is the simplest option. Add ANTHROPIC_API_KEY to your repository secrets and reference it in the workflow. This works for most individual developers and small teams.

Workload Identity Federation (WIF) eliminates stored secrets entirely. The action exchanges the workflow's GitHub Actions OIDC token for a short-lived Anthropic access token. There is no API key to create, store, or rotate. This is the strongest security option for teams that want zero persistent credentials.

Amazon Bedrock lets you run Claude through your AWS infrastructure. Configure an OIDC identity provider in AWS, create an IAM role with Bedrock permissions, and authenticate in your workflow:

steps:
  - name: Configure AWS Credentials
    uses: aws-actions/configure-aws-credentials@v4
    with:
      role-to-assume: ${{ secrets.AWS_ROLE_TO_ASSUME }}
      aws-region: us-west-2
  - uses: anthropics/claude-code-action@v1
    with:
      use_bedrock: "true"
      claude_args: "--model us.anthropic.claude-sonnet-4-6"

Note that Bedrock model IDs include a region prefix (us.anthropic.claude-sonnet-4-6), which differs from direct API model names.

Google Vertex AI works similarly. Enable Workload Identity Federation in Google Cloud, create a service account with Vertex AI User permissions, and set the use_vertex flag in your workflow. The project ID is automatically retrieved from the Google Cloud authentication step, so you don't need to hardcode it.

Both Bedrock and Vertex AI require a custom GitHub App instead of the official Claude app. Create one at github.com/settings/apps/new with Contents, Issues, and Pull Requests permissions set to read and write. Generate a private key, note the App ID, and add both as repository secrets. Then use actions/create-github-app-token to generate tokens in your workflow.

Custom GitHub Apps also work for direct API users who want full control. You choose the username that appears on commits and comments, manage permissions independently, and avoid installing third-party apps. The tradeoff is more initial setup for more organizational control.

Give your CI/CD agents a persistent workspace

Fast.io provides shared storage with MCP access at mcp.fast.io, so agents can read, write, and share files across GitHub Actions runs and coding sessions. Starts with a 14-day free trial.

Start 14-Day Trial

Once GitHub Actions is configured, Claude Code responds to several types of repository events. The most useful capabilities fall into four categories.

Interactive mentions let anyone on the team ask Claude for help directly in an issue or PR comment. Mention @claude with a question or a request, and Claude reads the surrounding thread context to respond or implement changes by pushing commits to a branch. This works well for ad-hoc requests that don't require a separate workflow trigger.

Automated PR review runs whenever new commits are pushed to a pull request. Claude diffs the changes against the coding standards defined in your repository's CLAUDE.md and posts inline comments on specific lines. A confidence filter suppresses low-confidence findings so review threads stay focused on substantive issues rather than style preferences.

CI failure recovery can be configured to trigger when a workflow run fails. Rather than just surfacing the failing test name, Claude analyzes the error in context, identifies a likely fix, and opens a follow-up PR with the proposed change. This turns broken builds from blockers into reviewable patches.

Scheduled tasks let you run Claude on a cron schedule for daily summaries, stale PR cleanup, or recurring reports. The prompt input accepts both plain text instructions and skill invocations, which lets you reuse repository-level skills inside automated workflows.

Your CLAUDE.md file shapes how Claude behaves across all of these triggers. Standards, review criteria, and preferred approaches defined there apply consistently whether Claude is responding to a mention, reviewing a PR, or running a nightly task.

For repositories that produce artifacts beyond code (test reports, generated docs, build specifications), services like Fast.io provide intelligent workspaces where those files become searchable and shareable. Enable Intelligence Mode on a workspace and every uploaded file is automatically indexed for semantic search, so both agents and team members can find outputs by meaning rather than filename.

GitHub Enterprise Server (GHES) support lets organizations use Claude Code with repositories on self-hosted GitHub instances. This is available for Team and Enterprise plans and requires a one-time admin setup.

GHES supports Claude Code web sessions, automated code review, security scanning, teleport sessions (moving sessions between web and terminal), plugin marketplaces, contribution metrics, and GitHub Actions. The GitHub MCP server is the one feature that does not currently work with GHES; use the gh CLI configured for your GHES host as a workaround.

Admin setup is handled through the Claude Code admin settings panel, where an administrator enters the GHES hostname and optionally a CA certificate for instances using self-signed certificates. The guided setup creates a GitHub App on your GHES instance with the permissions Claude needs to access repository content, pull requests, issues, and CI workflows. After creating the app, install it on the repositories or organizations you want Claude to access, then enable code review, security scanning, and contribution metrics from the same settings page.

Developer workflow requires no extra configuration once admin setup is complete. Claude Code detects the GHES hostname from your git remote automatically. Clone a repository from your GHES instance, open Claude Code in that directory, and it connects to the right GitHub instance without additional flags. Web sessions and teleport (pulling a web session into your local terminal) both work across GHES repositories.

Plugin marketplaces on GHES work similarly to github.com marketplaces, but reference plugins by full git URL rather than the owner/repo shorthand. Admins can pre-register GHES marketplaces in managed settings so developers see internal plugins without manual configuration.

Network requirements are the most common source of trouble. Your GHES instance must be reachable from Anthropic infrastructure so Claude can clone repositories and post review comments. When web sessions time out or code reviews fail to post, check network reachability and firewall rules first. The /install-github-app command works only with github.com; for GHES repositories, use the admin setup flow and configure workflow files manually.

CLAUDE.md is the primary way to shape Claude's behavior across all GitHub integrations. Place it in your repository root and define coding standards, review criteria, forbidden patterns, and preferred approaches. Claude reads this file before every interaction, whether it's responding to an @claude mention, reviewing a PR, or running a scheduled task.

Permissions should be limited to what's actually needed. For the basic @claude workflow, set issues: write and pull-requests: write. If Claude needs to push code, add contents: write. For Bedrock and Vertex AI authentication using OIDC, add id-token: write. Never grant more permissions than the workflow requires.

Cost management involves two separate bills. GitHub Actions minutes are consumed by the runner executing the workflow. Claude API tokens are consumed by the model processing each request. Both scale with usage, so controlling them matters as adoption grows. Practical steps include:

• Set --max-turns in claude_args to cap conversation depth (the default is 10)
• Use specific @claude commands rather than open-ended requests to reduce token consumption
• Add workflow-level timeouts to prevent runaway jobs
• Use GitHub's concurrency controls to limit parallel runs across PRs

Version migration from the beta to v1 requires a few changes to your workflow files. Change @beta to @v1, remove the mode parameter (now auto-detected), replace direct_prompt with prompt, and move CLI options like max_turns and model into the claude_args field. The v1 release simplifies configuration while adding features like automatic mode detection and skill invocation.

Organizing generated outputs becomes its own challenge for teams running Claude Code across multiple repositories and workflows. Code changes live in Git, but reports, specifications, and deliverables that come out of automated workflows need a persistent, searchable home. You could store them in S3 buckets or Google Drive folders, but those don't index files for search or give agents programmatic access. Fast.io workspaces handle both: agents write files through the MCP server at mcp.fast.io, and humans access those same files through the web interface with built-in RAG search. When an agent finishes building a project, ownership transfer hands the entire workspace to a human while the agent retains admin access. Every org starts with a 14-day free trial, and paid plans scale storage and monthly credits to each tier.