How do you run Claude Code in GitHub Actions for a team?

Run /install-github-app inside Claude Code, in the repository you want to connect. It installs the Claude GitHub App, saves your credential as a repository secret and opens a pull request with the workflow file.

You need admin access to the repository and the GitHub CLI signed in with gh auth login. The command works only for github.com repositories.

The manual route is the same three pieces: install the app, add the secret, and copy examples/claude.yml from the action's repository into .github/workflows/.

The action runs in one of two modes:

• Interactive: with no prompt input, it waits for @claude in an issue or pull request comment and answers there.
• Automation: with a prompt input, it runs on the workflow's event, such as a schedule, and writes to the run log by default.

By default, only a user with write access to the repository can trigger it on an issue or pull request. A bot cannot, unless it is listed in allowed_bots.

Anthropic's documentation names four ways for the action to authenticate:

For an organisation, Anthropic suggests installing the app once, storing the secret at the organisation level, and calling one reusable workflow from each repository.

Federation stores no long-lived secret at all. It needs the id-token: write permission on the workflow.

Each run uses two things:

• GitHub Actions minutes on GitHub-hosted runners, billed by GitHub.
• Model tokens, which grow with the prompt, the task and the size of the codebase. With an OAuth token, runs use that person's Claude subscription instead of API billing.

Anthropic's own advice for keeping both down:

• Set --max-turns in claude_args to bound how long Claude works.
• Set timeout-minutes on the job, so a runaway run ends.
• Use GitHub's concurrency controls to limit parallel runs.
• Keep CLAUDE.md short, because Claude reads it on every run.

None of these is a budget. A turn limit bounds one run; it does not stop the hundredth run in a month. What a developer's Claude Code costs a day is in the cost-per-developer guide.

One secret shared by every repository means every run bills to one credential. A subscription token is one person's plan doing the whole organisation's CI.

Turn limits and timeouts bound each run, not the total across every repository and job.

With a plain run step instead of the action. The job installs selan and Claude Code, then runs an agent from the repository's .claude/agents/ with selan agent-run, signed in by a SELAN_TOKEN secret.

• No provider key in GitHub. The company's provider accounts stay on Selan, and the job holds only its token.
• A token per job. An owner mints each one under Settings → API tokens. It spends as itself, under an address like ci-review@tokens.selan.ai, so its runs show up as that job in Usage and Logs.
• A limit per job. The company's per-person spend limit applies to a token as it does to a person, and a token can be given a limit of its own. How limits work is on the spend page.
• API keys only, if you want. An owner can switch a token to API only. Selan then serves it only from the company's own API keys and skips every connected subscription account.
• One revoke. Revoking a token ends that job's access without touching any other job.

A complete workflow, with the step that posts the review, is on the code review page. GitLab CI needs more than a path change: container images run as root, which Claude Code refuses with permissions skipped, so the job drops to a user. That pipeline is on the same page. How the token works is in Agents in CI.

When you want @claude in comments. The action answers a mention in the thread, shows its progress in a comment there and can push commits as the Claude GitHub App. Selan's documented route writes a file, and the pipeline decides what to post.

When one repository uses it, a single API key in one secret is simple and enough. Selan earns its place once several repositories and jobs share the bill and you want each one shown and capped on its own, next to the people on the team.

Free for up to three seats, and the Free plan needs no card. A CI token takes a seat of its own on a paid plan; the Free plan is people only.