CI/CD with Agents: AI in the Pipeline

The building block: headless calls

A pipeline has no chat window. The entry point is therefore headless mode: claude -p "prompt" works through a task and exits. You can pipe data in (git diff main | claude -p "..."), and --output-format json returns a machine-readable result including cost — good for scripts.

GitHub Actions

For GitHub there is an official action (claude-code-action): it responds to @claude mentions in issues and PRs, or runs automatically with a fixed prompt — for example as a review on every new pull request. The API key must go into GitHub Secrets, never into the repository.

Gates: tests before trust

The most important rule: agent output is unreviewed code. It has to pass the same gates as human code — tests, linters, the build — before anything gets merged. In practice, that means the agent opens a pull request instead of pushing directly, and a human reviews before the merge.

The risks

First: no follow-up questions. Whatever the agent cannot decide gets aborted or decided wrongly. Second: secrets — an agent in CI can access everything the runner sees, so keep permissions as narrow as possible. Third: cost — without limits like --max-turns and workflow timeouts, runs can quietly get expensive.