---

name: cc-actions description: | Configure Claude Code GitHub Actions workflows effectively. Covers automatic mode detection, event routing, subagent coordination, hooks for quality gates, MCP server integration, reusable workflows, performance optimization, and security best practices for fork-based PRs. Use when working with GitHub Actions, CI/CD automation, PR reviews, issue automation, claude-code-action, chatops, MCP servers, fork safety, or reusable workflows. user-invocable: true allowed-tools: Read Write Edit Glob Grep Bash

Claude Code GitHub Actions

Configure automation using anthropics/claude-code-action with event routing, subagents, hooks, and MCP integration.

Quick Start

Copyname: Claude Code
on:
  issue_comment: { types: [created] }
  pull_request: { types: [opened, synchronize] }
  issues: { types: [opened, labeled] }

permissions:
  contents: write
  pull-requests: write
  issues: write

jobs:
  claude:
    if: github.actor != 'github-actions[bot]'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: anthropics/claude-code-action@v1
        with:
          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}

Core Concepts

Key Patterns

Event Routing

Copyjobs:
  pr-comment:
    if: github.event_name == 'issue_comment' && github.event.issue.pull_request
  issue-comment:
    if: github.event_name == 'issue_comment' && !github.event.issue.pull_request
  label-triggered:
    if: contains(github.event.issue.labels.*.name, 'claude-implement')

Subagents

Copyprompt: |
  Delegate to 3 parallel subagents:
  1. Security Agent: OWASP Top 10, auth checks
  2. Performance Agent: N+1 queries, memory leaks
  3. Style Agent: Naming, documentation, tests

Hooks

Copy{
  "hooks": {
    "PostToolUse": [{
      "matcher": "Edit|Write",
      "hooks": [{ "type": "command", "command": "npx prettier --write $(jq -r '.tool_input.file_path')" }]
    }],
    "Stop": [{
      "hooks": [{ "type": "command", "command": "npm run lint && npm test" }]
    }]
  }
}

Performance

Copyconcurrency:
  group: claude-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

on:
  pull_request:
    paths: ['src/**', '!**/*.md']

Tuning Reference

Critical Gotchas

1. --allowedTools vs --disallowedTools

   • allowedTools only skips prompts—does NOT restrict tools
   • Use disallowedTools to actually block: --disallowedTools Bash,Run,Edit

2. MCP + Subagents

   • MCP tools do NOT work in background subagents
   • Always run MCP operations in foreground

3. Fork Safety

   • pull_request event = safe (read-only token, no secrets)
   • pull_request_target = dangerous if you checkout fork code
   • Never: checkout ref: ${{ github.event.pull_request.head.sha }} with secrets

4. Hook Exit Codes

   • 0 = continue
   • 2 = block, feed stderr to Claude
   • Other = log error, don't block

5. Subagent Limits

   • ~10 concurrent subagents max
   • Additional tasks queue

Examples

See examples/ for 14 production-ready use cases:

Patterns

• Event Routing - Conditions, label routing, author associations
• Subagents - Creation, parallel execution, built-in types
• Hooks - All events, exit codes, JSON parsing, examples
• Permissions - Tool control layers, known issues
• Security - Fork handling, external contributors, safe patterns
• Reusable Workflows - workflow_call, composite actions
• Performance - Concurrency, caching, path filtering
• Skills - Domain expertise, skill structure, hooks

Official Docs

Synced from anthropics/claude-code-action:

• Configuration - MCP servers, settings, custom tools
• Security - API key protection, commit signing
• Usage - Inputs, outputs, migration guide