Home / Guides / Claude

Claude code review in GitHub Actions

Updated July 4, 2026 · applies to pgup-ai/jbot-review-action v0

To get Claude reviewing your pull requests inside your own GitHub Actions, add one workflow file and one repo secret (ANTHROPIC_API_KEY). J-Bot Review — an open-source (MIT) action — drives Claude on your key and your runner, and posts diff-anchored findings that a second session verifies before they land on the PR. No reviewer SaaS, $0 per seat added.

Setup in three steps

1. Add the secret. Create an API key in the Anthropic Console and save it as the repository secret ANTHROPIC_API_KEY (Settings → Secrets and variables → Actions).
2. Commit the workflow. Add the file below as .github/workflows/jbot-review.yml.
3. Open a pull request. Claude reviews the full base…head diff on your runner and posts review comments with a verdict; blocking findings are adversarially verified first, nits demoted.

name: J-Bot Code Review
on:
  pull_request: { types: [opened, reopened, ready_for_review, synchronize] }

concurrency:
  group: jbot-review-${{ github.event.pull_request.number }}
  cancel-in-progress: true

permissions:
  contents: read
  pull-requests: write
  issues: write        # PR reactions use the issues API
  checks: read

jobs:
  review:
    if: github.event.pull_request.draft == false
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
        with: { fetch-depth: 0 }
      - uses: pgup-ai/jbot-review-action@v0
        with:
          provider: anthropic
          # model: <id from models.dev>   # optional — provider default when unset
          anthropic-api-key: ${{ secrets.ANTHROPIC_API_KEY }}
          github-token: ${{ secrets.GITHUB_TOKEN }}

What Claude reviews, exactly

• The full diff — base…head, not just the latest push — with read-only access to your checkout for context.
• Your house rules: the reviewer discovers AGENTS.md, REVIEW.md, .coderabbit.yaml, greptile.json, and Cursor rules, and reviews against them.
• Current docs: when a PR touches an external API or SDK, Context7 checks the change against live documentation.
• Verified output: every blocking finding is re-checked in a dedicated session before posting — refuted findings are dropped, uncertain ones demoted to advisory.

Cost & privacy

• You pay Anthropic only. J-Bot adds no per-seat or per-review charge. Defaults keep spend low: one review pass, doc-only PRs skipped without a model call, prompt caching on.
• Trim further with min-severity, or route verification to a cheaper backend via aux-provider / aux-model — including free OpenCode Zen models.
• Data path: only the diff and the context the agent requests reach the Anthropic API, under your own account and its retention terms. No third-party reviewer sees your code.
• Fork PRs: on pull_request events GitHub strips secrets from fork PRs, so outside contributors can't spend your key.

FAQ

Related