CI/CD with agents: GitHub Actions and PR review

The junta de freguesia (parish council) has a small program for bookings of the multi-purpose hall. On a Friday, Pedro, who helps in his spare time, changed one line to fix a date and sent it to GitHub. On Saturday nobody could book anything. The tests existed and would have caught the mistake. But nobody ran them.

The concept: a machine that runs the tests for you

Continuous integration (CI) means this: every time someone sends a change, a separate machine downloads the project, installs what it needs and runs the tests. On the pull request you see a green tick or a red cross. Nobody forgets, because nobody has to remember.

Continuous delivery (the CD) is the next step: publishing by itself when the tests pass. That waits until you trust your tests.

Agents plug into the same mechanism. Instead of only running tests, the machine calls an agent that reads the pull request and leaves comments. The rule of this lesson is simple: the agent comments, the person decides.

How it is done today: the first workflow

This is how it looks on 6 October 2026; your screen may differ. Look for the button with the same name. Guide: docs.github.com/en/actions/tutorials/build-and-test-code/python.

In the project from lesson 2/07, create the file .github/workflows/testes.yml (testes is Portuguese for “tests”):

name: Testes
on: [push, pull_request]
jobs:
  testes:
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@v6
      - uses: actions/setup-python@v5
        with:
          python-version: '3.x'
      - name: Instalar
        run: |
          python -m pip install --upgrade pip
          pip install -r requirements.txt
      - name: Test with pytest
        run: pytest

Read it from top to bottom: it runs on every push and every pull request, on a Linux machine from GitHub, and gives up after 10 minutes. The steps download the code, install Python and the dependencies, and run pytest. The requirements.txt has to include pytest.

The key stays in a secret

In the repository, open Settings. In the “Security” section of the sidebar, choose Secrets and variables and then Actions. Click New repository secret, name it ANTHROPIC_API_KEY (or OPENAI_API_KEY), paste the value and confirm with Add secret.

PR review with Claude

The official integration is called Claude Code GitHub Actions and uses the action anthropics/claude-code-action@v1. Guide: code.claude.com/docs/en/github-actions.

The quick way: open claude inside the repository and run /install-github-app. It installs the GitHub app, saves the secret and prepares the workflow in a pull request. You need to be an administrator of the repository, and it only works with repositories on github.com.

The manual way: install the Claude GitHub app, create the secret and copy the example file claude.yml, linked in the guide, into .github/workflows/. From then on, you write @claude in a PR comment and it answers. The guide also has a workflow that reviews every open PR on its own.

The Codex equivalent

The official action is openai/codex-action@v1, with the key in openai-api-key: ${{ secrets.OPENAI_API_KEY }} and the request in a file, for example .github/codex/prompts/review.md. The official example separates the jobs: Codex only reads the code, and another step, with permission to write comments, publishes the answer. Guide: learn.chatgpt.com/docs/github-action.

The house rules

• Never give the agent merge permission in a real project. It proposes and comments; a person approves.
• Protect the main branch. In Settings, in the “Code, planning, and automation” section, choose Branches and then Add classic branch protection rule. Turn on Require a pull request before merging and Require status checks to pass before merging, and pick your test in the search field that appears. If there are more people on the project, also turn on Require approvals. By default, whoever administers the repository can bypass the rule; the guide shows how to apply it to administrators too.
• The text of a PR is data, not instruction. A PR can carry sentences written to trick the agent (lesson 2/04). Both actions only accept requests from people with write access to the repository, and the Codex guide recommends cleaning the text before giving it to the model.

What each run costs

Each run spends GitHub Actions minutes and model tokens. Three controls help: run the review only when a PR is opened or updated, not on every push; the timeout-minutes setting; and, in Claude, --max-turns on the claude_args line. The brake for the month is still the spending limit in the provider's console. Amounts change: see the Current state page.