Claude Code GitHub Actions: 8 Secure Workflows + Linter

python3 tools/install.py /path/to/repo --dry-run
python3 tools/install.py /path/to/repo --only pr-review --only issue-triage --only ci-failure-explainer --ci-workflow "Tests"

Then: add an ANTHROPIC_API_KEY repository secret (or run /install-github-app in Claude Code, which also installs the Claude GitHub App), create the claude-review label if you use the fork workflow, and run the linter. Existing workflow files are kept unless you pass --force (a .bak is saved).

Bedrock, Vertex AI or Foundry: replace anthropic_api_key with the provider inputs from the action's cloud-providers guide; the linter accepts those.

What "hardened" means here, in every workflow:

• actions pinned to full commit SHAs (claude-code-action v1 and actions/checkout v7.0.1, Nov 2026), with the version in a comment
• least-privilege permissions: per job, timeout-minutes, and a concurrency group so rapid pushes cancel the old paid run
• --max-turns caps on every run and --allowedTools lists of exact commands (Bash(gh pr diff:*)), never open Bash
• no untrusted text (issue titles, PR bodies, comments, branch names) pasted into prompts or shell steps; prompts tell Claude to treat that content as data
• workflow_run and pull_request_target never check out PR code at the workspace root (the CI explainer puts it in pr-head/ and passes --add-dir, as the action's security guide recommends)

python3 tools/claude_action_lint.py .github/workflows            # exit 1 on errors
python3 tools/claude_action_lint.py .github/workflows --strict   # also fail on warnings (for CI)

Errors: PR head checked out at the workspace root on pull_request_target / workflow_run; untrusted github.event text inside run:; permissions: write-all; API keys written in the file or not read from secrets; no authentication input; --dangerously-skip-permissions on PR/comment events; allowed_non_write_users without github_token: ${{ secrets.GITHUB_TOKEN }} (or with a personal access token), or set to * while Claude has write access. Warnings: unpinned actions, no permissions block, no timeout-minutes, no concurrency on PR workflows, no --max-turns, open Bash in --allowedTools, untrusted text pasted into the prompt, allowed_bots: '*', claude-code-base-action on PR/comment events (no actor checks). Info: fork PRs that will fail for lack of secrets; comment-triggered jobs without an if: filter.

--json gives machine-readable results with file, job and line.

./tools/demo.sh lints the 8 workflows (0 errors, 0 warnings), lints examples/bad-workflows (2 files, 8 errors, 13 warnings), installs 3 workflows into a temp repo and lints them with --strict.

./run_tests.sh (15 tests, Python 3.9+): all 8 workflows parse and lint clean in strict mode; every job has permissions, a timeout of 30 minutes or less, one pinned Claude step with --max-turns and the key from secrets; only the @claude workflow can write code; the fork workflow never checks out PR code; no untrusted text in prompts; each linter rule fires on a bad example and stays quiet on the safe version; installer and CLI exit codes; the demo runs.

• These workflows and the linter reduce risk; they don't make prompt injection impossible. Keep permissions minimal and review what Claude posts or pushes.
• The linter reads workflow YAML statically (no anchors/aliases); it does not run your workflows or call GitHub.
• Costs depend on your model, PR size and turn caps; check your Anthropic usage after the first week.
• Written against claude-code-action v1 docs as of November 2026. When you update the pinned SHA, re-run the linter.