Claude Code in GitHub Actions: Review Trusted Java Changes

Claude Code in GitHub Actions runs an agent on a runner with the credentials and repository access you grant it. A workflow sample must specify which code is trusted before recommending permissions or model credentials.

The earlier version used outdated action inputs, unsupported price estimates, and an automatic repair workflow without sufficient trust checks. This revision is a setup and review procedure, not a claim that a copied workflow is ready for every repository.

Follow the maintained action configuration

Anthropic’s GitHub Actions guide and the action repository describe setup and authentication. The action uses inputs such as prompt and claude_args; do not assume old top-level model or max-turns fields are supported by the selected action version.

For reproducibility, review and pin action revisions rather than relying indefinitely on a moving tag. Record the model, invocation limit, runner runtime, and authentication arrangement used for the job. A subscription plan is not a promise that arbitrary CI use is free.

Establish the trust boundary before supplying secrets

Decide who may trigger the job, which revision it reads, and whether it executes repository code. A fork pull request, issue text, workflow artifact, and retrieved document are untrusted inputs.

GitHub’s secure-use reference explains risks around privileged workflows and untrusted checkout. Do not combine elevated pull_request_target or workflow_run credentials with arbitrary pull-request code or downloaded artifacts merely because the previous build failed.

Start with a manually triggered review of a trusted revision or the provider’s maintained supported pattern. Give the job only the permissions it needs. Posting a comment, modifying a branch, and approving or merging a pull request are separate capabilities.

Give the reviewer a precise Java contract

Supply the base and head revisions, relevant requirement, module, and build instructions. Require each finding to identify a reachable failure and a verification step. Full history is not always required; the important fact is that the intended comparison revisions are available.

For Spring Boot, ask about ownership, transaction boundaries, profile-dependent beans, and the specific tests affected by the patch. The AI review guide provides concrete checks.

Never inject untrusted issue or PR text directly into a shell command. Pass data through the documented input mechanism, and keep it data rather than treating it as a privileged instruction.

Run application verification independently

Keep a build job that does not depend on the agent’s interpretation of success. Preserve pipeline exit codes and inspect fresh test reports. The CI contract guide covers this distinction.

If a required database or Docker daemon is unavailable, report the blocker. Do not disable integration tests to make an automated repair job appear successful. A patch changing assertions or business rules needs review against the requirement.

Bound usage and writes

Use the action’s documented argument mechanism to set supported limits. A turn count is not a monetary ceiling; observe actual usage and provider billing controls. Remove unverified per-review cost estimates from budgeting.

If automated patch creation is necessary, place the result on a reviewable branch and retain the starting revision, diff, checks, and limitations. Do not equate a successful model invocation with authorization to merge.

Trial the complete workflow

Test an authorized trigger, an unauthorized trigger, a passing build, a failing build, a missing credential, and a tool-limit failure. Check that logs do not expose secrets and that an unsuccessful review cannot mark the application verification as passed.

Use the Claude Code repository workflow for local task discipline, the Boot 4 instruction template for acceptance criteria, and the Java hub for related scenarios. A review automation is useful when its trust boundary and output are understandable to the person accepting the change.