Skip to main content

How to Set Up Claude Code Review in GitHub Actions (5 Minutes)

· 3 min read
David Watts
David Watts
Software Developer

Want Claude to review every pull request in your repo automatically? With Cody it takes about five minutes and requires no hosting — just a GitHub Actions workflow and your Anthropic API key. Here's the full setup.

Step 1 — Add your Anthropic API key​

Create an API key at platform.claude.com, then add it to your repo as a secret:

Settings → Secrets and variables → Actions → New repository secret, named ANTHROPIC_API_KEY.

GITHUB_TOKEN doesn't need to be added — GitHub provides it to workflows automatically.

Step 2 — Add the workflow file​

Create .github/workflows/code_review.yml in your repo:

name: Private AI PR Review by Cody

on:
  # The workflow definition comes from the protected base branch. Do not add a
  # checkout step or execute code from the pull request while secrets are present.
  pull_request_target:
    types: [opened, synchronize, reopened]

jobs:
  code_review:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: write
    steps:
      - name: Review pull request
        # Pinned to the v1.7.0 release commit; see
        # https://github.com/codylabs/cody-code-reviewer/releases for newer releases.
        uses: codylabs/cody-code-reviewer@5ec18da9b75541f5ce2b33edcfb8a7c666551b31 # v1.7.0
        with:
          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
          model: claude-opus-4-8

The pull request number, repository and GitHub token are read from the workflow context automatically, so the API key and model are the only configuration needed.

pull_request_target makes the protected base-branch workflow available for fork contributions without handing control of it to the pull request. Keep this job review-only: never check out or execute pull-request code in a job that receives secrets.

Protect the default branch and require owner or CODEOWNERS review for changes to this workflow and its Action pin. A collaborator who can modify the base-branch workflow can modify what executes with its secrets.

The important line is model: claude-opus-4-8 — any claude-* model name routes the review to Anthropic. Prefer a cheaper review? Use claude-sonnet-5 or claude-haiku-4-5 instead.

Step 3 — Open a pull request​

That's it. On your next pull request, Cody fetches the diff through the GitHub API, asks Claude for actionable findings, and posts the result as a PR comment. No pull-request code needs to run.

Troubleshooting​

  • No comment appears? Check the Actions run logs, and make sure the workflow has pull-requests: write permission (included in the YAML above).
  • Authentication error? Confirm the ANTHROPIC_API_KEY secret name matches exactly and the key is active.
  • Want reviews on GitLab or Azure DevOps? That's available in Cody Pro.

More details in the Quick Start Documentation.

Keywords: Claude code review GitHub Actions, Anthropic API GitHub Actions, automated PR review Claude, Claude Opus 4.8 tutorial, AI code review setup, GitHub Actions AI review workflow, CodyLabs, 2026