Use Claude Code GitHub Actions with cloud providers changedgithub-actions-cloud-providers
Nearest release: v2.1.273, published 3 hours before upstream edited the page. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Upstream edited this page at 15 Sep 2026 21:21 UTC, give or take a minute or two: the time comes from Anthropic’s own sitemap rather than from a commit. This site recorded the change at 20 Oct 2026 18:37 UTC.
Upstream edited
Recorded here
Lines+258added
Lines−264removed
From line
4
where the diff opens
First seen
14 Aug 2026
this site's first read of the page
Recorded edits5to this page, all time
The whole hunk
from line 4, old and new numbered
/
The two sides of this change are more than 400 edits apart, too far apart to line up, so this is the differ's own diff of it and the words inside a line are not marked.
from line 4
44
55[Claude Code GitHub Actions](/docs/en/github-actions) calls the Claude API by default. To route inference through your own cloud account instead, set the Claude Code GitHub Action's provider input and configure your cloud to trust the workflow's OpenID Connect (OIDC) token. The workflow authenticates with that token, so you store no long-lived cloud credential in your repository.
66
7<Info>
8 This page builds on the [GitHub Actions setup](/docs/en/github-actions#setup). It assumes you already know the workflow file and the `anthropics/claude-code-action` step, and covers only what a cloud provider changes.
9</Info>
7> [!NOTE]
8>
9> This page builds on the [GitHub Actions setup](/docs/en/github-actions#setup). It assumes you already know the workflow file and the `anthropics/claude-code-action` step, and covers only what a cloud provider changes.
1010
1111## Choose your provider
1212
from line 33
3333
3434Beyond the prerequisites, you create a GitHub identity for the Claude Code GitHub Action, the cloud-side trust configuration, the repository secrets, and the workflow file. The steps below walk through each.
3535
36<Steps>
37 <Step title="Choose a GitHub identity">
38 The Claude Code GitHub Action pushes commits and posts comments through a GitHub identity. The [quick setup](/docs/en/github-actions#quick-setup) installs the official Claude GitHub App for this. With a cloud provider, you choose the identity yourself:
39
40 * **Official [Claude GitHub App](https://github.com/apps/claude)**: install it on the repository, or skip to the next step if it's already installed
41 * **Custom GitHub App**: create your own app when you want only the three permissions the Claude Code GitHub Action uses rather than the [official app's full set](/docs/en/github-actions#github-app-permissions)
42 * **GitHub's automatic `GITHUB_TOKEN`**: no app to create or install, but GitHub doesn't trigger your CI workflows on commits made with it
43
44 The workflow examples in the fourth step authenticate with a custom app. That step also says what to change for the other two options.
45
46 To create a custom app, [register a new GitHub App](https://docs.github.com/en/apps/creating-github-apps/registering-a-github-app/registering-a-github-app) with webhooks disabled, since this integration doesn't use them. Grant it three repository permissions:
47
48 * **Contents**: read and write
49 * **Issues**: read and write
50 * **Pull requests**: read and write
51
52 After registering the app, generate a private key and keep the downloaded `.pem` file, note the App ID from the app's settings page, and [install the app](https://docs.github.com/en/apps/using-github-apps/installing-your-own-github-app) on the repository where the Claude Code GitHub Action runs. You add the key and the ID as secrets in the third step.
53 </Step>
54
55 <Step title="Configure cloud authentication">
56 Configure your cloud to trust the OIDC token that GitHub issues to the workflow, so each workflow run gets short-lived cloud credentials. The bullets in each tab summarize what to create, and each tab links the cloud vendor's own guide for the console-level steps.
57
58 <Tabs>
59 <Tab title="Amazon Bedrock">
60 Create the trust configuration in your AWS account, following the [AWS guide to creating OIDC identity providers](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_create_oidc.html):
61
62 * Add a GitHub OIDC identity provider with provider URL `https://token.actions.githubusercontent.com` and audience `sts.amazonaws.com`
63 * Create an IAM role trusted by that provider as a web identity, and attach the scoped invocation policy from [IAM configuration](/docs/en/amazon-bedrock#iam-configuration), which grants `bedrock:InvokeModel`, `bedrock:InvokeModelWithResponseStream`, `bedrock:ListInferenceProfiles`, and `bedrock:GetInferenceProfile`, along with two `aws-marketplace` subscription actions
64 * Limit the role's trust policy to your repository with a subject condition such as `repo:your-org/your-repo:*`. See [GitHub's OIDC hardening guide](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect) for the claim format
65
66 Note the role's ARN. You add it as a secret in the next step.
67 </Tab>
68
69 <Tab title="Google Cloud's Agent Platform">
70 Create the federation resources in your Google Cloud project, following the [Workload Identity Federation documentation](https://cloud.google.com/iam/docs/workload-identity-federation):
71
72 * Enable three APIs: IAM Credentials, Security Token Service (STS), and the Agent Platform API, whose service name is `aiplatform.googleapis.com`
73 * Create a Workload Identity Pool with a GitHub OIDC provider whose issuer is `https://token.actions.githubusercontent.com`, and add an attribute condition that limits the pool to your repository
74 * Create a dedicated service account with only the `Vertex AI User` role, which is `roles/aiplatform.user`, and allow the pool to impersonate it
75
76 Note the provider's full resource name and the service account's email address. You add them as secrets in the next step.
77 </Tab>
78
79 <Tab title="Microsoft Foundry">
80 Create a Microsoft Entra application with a federated credential for your repository, following [Microsoft's guide to authenticating from GitHub Actions](https://learn.microsoft.com/en-us/azure/developer/github/connect-from-azure-openid-connect):
81
82 * Register a Microsoft Entra application and add a federated identity credential that trusts tokens GitHub issues to your repository. A user-assigned managed identity works in place of an application. Both have the client ID you note below
83 * Assign the application the `Azure AI User` role on your Foundry resource. See [Azure RBAC configuration](/docs/en/microsoft-foundry#azure-rbac-configuration) for a narrower custom role
84
85 Note the application's client ID, your tenant ID, and your subscription ID. You add them as secrets in the next step.
86 </Tab>
87 </Tabs>
88 </Step>
89
90 <Step title="Add repository secrets">
91 In the repository where the Claude Code GitHub Action runs, add the secrets for your provider, plus the two app secrets if you created a custom GitHub App in the first step. See GitHub's guide to [using secrets in GitHub Actions](https://docs.github.com/en/actions/security-guides/using-secrets-in-github-actions).
92
93 | Secret | Needed for | Value |
94 | - | - | - |
95 | `AWS_ROLE_TO_ASSUME` | Amazon Bedrock | The ARN of the IAM role |
96 | `GCP_WORKLOAD_IDENTITY_PROVIDER` | Google Cloud's Agent Platform | The provider's full resource name |
97 | `GCP_SERVICE_ACCOUNT` | Google Cloud's Agent Platform | The service account's email address |
98 | `AZURE_CLIENT_ID` | Microsoft Foundry | The Entra application's client ID |
99 | `AZURE_TENANT_ID` | Microsoft Foundry | Your Microsoft Entra tenant ID |
100 | `AZURE_SUBSCRIPTION_ID` | Microsoft Foundry | Your Azure subscription ID |
101 | `APP_ID` | Custom GitHub App | The GitHub App's ID |
102 | `APP_PRIVATE_KEY` | Custom GitHub App | The contents of the `.pem` private key file |
103 </Step>
104
105 <Step title="Create the workflow file">
106 Create a workflow file for your provider, such as `.github/workflows/claude.yml`. Each example responds to `@claude` mentions, authenticates to GitHub with a custom app, and includes the `id-token: write` permission, which GitHub requires to issue the OIDC token that your cloud provider exchanges for credentials.
107
108 If you chose a different GitHub identity in the first step, adjust the example:
109
110 * **Official Claude GitHub App**: delete the Generate GitHub App token step and the `github_token` line
111 * **GitHub's automatic token**: delete the token-generation step and change the `github_token` line to `github_token: ${{ secrets.GITHUB_TOKEN }}`
112
113 <Warning>
114 On public repositories, a comment containing the trigger phrase from any user starts this workflow. The credential steps run before the Claude Code GitHub Action checks the commenter's write access, so the action rejects unauthorized users only after the workflow has generated an App token and signed in to your cloud provider, which leaves audit-log entries and consumes Actions minutes. To avoid those runs, add a step that verifies the commenter's write access before the credential steps.
115 </Warning>
116
117 <Tabs>
118 <Tab title="Amazon Bedrock">
119 Replace the `aws-region` value with your own. The credentials step exports it as `AWS_REGION` for the rest of the job.
120
121 ```yaml theme={null}
122 name: Claude PR Action
123
124 permissions:
125 contents: write
126 pull-requests: write
127 issues: write
128 id-token: write
129
130 on:
131 issue_comment:
132 types: [created]
133 pull_request_review_comment:
134 types: [created]
135 issues:
136 types: [opened]
137
138 jobs:
139 claude-pr:
140 if: |
141 (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) ||
142 (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) ||
143 (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')))
144 runs-on: ubuntu-latest
145 steps:
146 - name: Checkout repository
147 uses: actions/checkout@v6
148
149 - name: Generate GitHub App token
150 id: app-token
151 uses: actions/create-github-app-token@v2
152 with:
153 app-id: ${{ secrets.APP_ID }}
154 private-key: ${{ secrets.APP_PRIVATE_KEY }}
155
156 - name: Configure AWS Credentials (OIDC)
157 uses: aws-actions/configure-aws-credentials@v4
158 with:
159 role-to-assume: ${{ secrets.AWS_ROLE_TO_ASSUME }}
160 aws-region: us-west-2
161
162 - uses: anthropics/claude-code-action@v1
163 with:
164 github_token: ${{ steps.app-token.outputs.token }}
165 use_bedrock: "true"
166 claude_args: '--model us.anthropic.claude-sonnet-4-6'
167 ```
168
169 <Tip>
170 Bedrock model IDs include a cross-region inference profile prefix such as `us.`. Use the prefix for the region group where you granted model access.
171 </Tip>
172 </Tab>
173
174 <Tab title="Google Cloud's Agent Platform">
175 Replace the `CLOUD_ML_REGION` value with your own. You don't need to hardcode the project ID, because the workflow reads it from the `auth` step's output.
176
177 ```yaml theme={null}
178 name: Claude PR Action
179
180 permissions:
181 contents: write
182 pull-requests: write
183 issues: write
184 id-token: write
185
186 on:
187 issue_comment:
188 types: [created]
189 pull_request_review_comment:
190 types: [created]
191 issues:
192 types: [opened]
193
194 jobs:
195 claude-pr:
196 if: |
197 (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) ||
198 (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) ||
199 (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')))
200 runs-on: ubuntu-latest
201 steps:
202 - name: Checkout repository
203 uses: actions/checkout@v6
204
205 - name: Generate GitHub App token
206 id: app-token
207 uses: actions/create-github-app-token@v2
208 with:
209 app-id: ${{ secrets.APP_ID }}
210 private-key: ${{ secrets.APP_PRIVATE_KEY }}
211
212 - name: Authenticate to Google Cloud
213 id: auth
214 uses: google-github-actions/auth@v2
215 with:
216 workload_identity_provider: ${{ secrets.GCP_WORKLOAD_IDENTITY_PROVIDER }}
217 service_account: ${{ secrets.GCP_SERVICE_ACCOUNT }}
218
219 - uses: anthropics/claude-code-action@v1
220 with:
221 github_token: ${{ steps.app-token.outputs.token }}
222 use_vertex: "true"
223 claude_args: '--model claude-sonnet-5'
224 env:
225 ANTHROPIC_VERTEX_PROJECT_ID: ${{ steps.auth.outputs.project_id }}
226 CLOUD_ML_REGION: us-east5
227 ```
228 </Tab>
229
230 <Tab title="Microsoft Foundry">
231 Replace `your-resource-name` with your Foundry resource name. Claude Code builds the endpoint URL from it. The `azure/login` step signs in with the workflow's OIDC token, and Claude Code picks up the credentials through the Azure [default credential chain](https://learn.microsoft.com/en-us/azure/developer/javascript/sdk/authentication/credential-chains#defaultazurecredential-overview).
232
233 ```yaml theme={null}
234 name: Claude PR Action
235
236 permissions:
237 contents: write
238 pull-requests: write
239 issues: write
240 id-token: write
241
242 on:
243 issue_comment:
244 types: [created]
245 pull_request_review_comment:
246 types: [created]
247 issues:
248 types: [opened]
249
250 jobs:
251 claude-pr:
252 if: |
253 (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) ||
254 (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) ||
255 (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')))
256 runs-on: ubuntu-latest
257 steps:
258 - name: Checkout repository
259 uses: actions/checkout@v6
260
261 - name: Generate GitHub App token
262 id: app-token
263 uses: actions/create-github-app-token@v2
264 with:
265 app-id: ${{ secrets.APP_ID }}
266 private-key: ${{ secrets.APP_PRIVATE_KEY }}
267
268 - name: Authenticate to Azure
269 uses: azure/login@v2
270 with:
271 client-id: ${{ secrets.AZURE_CLIENT_ID }}
272 tenant-id: ${{ secrets.AZURE_TENANT_ID }}
273 subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
274
275 - uses: anthropics/claude-code-action@v1
276 with:
277 github_token: ${{ steps.app-token.outputs.token }}
278 use_foundry: "true"
279 claude_args: '--model claude-sonnet-5'
280 env:
281 ANTHROPIC_FOUNDRY_RESOURCE: your-resource-name
282 ```
283
284 <Tip>
285 Use a model ID that matches a Claude deployment in your Foundry resource. See [Claude Code on Microsoft Foundry](/docs/en/microsoft-foundry) for model configuration and version pinning.
286 </Tip>
287 </Tab>
288 </Tabs>
289
290 With any provider, you can bound run length and cost by adding `--max-turns` to `claude_args`. See [Manage costs](/docs/en/github-actions#manage-costs).
291 </Step>
292
293 <Step title="Test the setup">
294 Mention `@claude` in an issue or PR comment, then watch the run in the repository's Actions tab. Claude replies in a comment on the same issue or PR.
295 </Step>
296</Steps>
36**1. Choose a GitHub identity**
37
38The Claude Code GitHub Action pushes commits and posts comments through a GitHub identity. The [quick setup](/docs/en/github-actions#quick-setup) installs the official Claude GitHub App for this. With a cloud provider, you choose the identity yourself:
39
40* **Official [Claude GitHub App](https://github.com/apps/claude)**: install it on the repository, or skip to the next step if it's already installed
41* **Custom GitHub App**: create your own app when you want only the three permissions the Claude Code GitHub Action uses rather than the [official app's full set](/docs/en/github-actions#github-app-permissions)
42* **GitHub's automatic `GITHUB_TOKEN`**: no app to create or install, but GitHub doesn't trigger your CI workflows on commits made with it
43
44The workflow examples in the fourth step authenticate with a custom app. That step also says what to change for the other two options.
45
46To create a custom app, [register a new GitHub App](https://docs.github.com/en/apps/creating-github-apps/registering-a-github-app/registering-a-github-app) with webhooks disabled, since this integration doesn't use them. Grant it three repository permissions:
47
48* **Contents**: read and write
49* **Issues**: read and write
50* **Pull requests**: read and write
51
52After registering the app, generate a private key and keep the downloaded `.pem` file, note the App ID from the app's settings page, and [install the app](https://docs.github.com/en/apps/using-github-apps/installing-your-own-github-app) on the repository where the Claude Code GitHub Action runs. You add the key and the ID as secrets in the third step.
53
54**2. Configure cloud authentication**
55
56Configure your cloud to trust the OIDC token that GitHub issues to the workflow, so each workflow run gets short-lived cloud credentials. The bullets in each tab summarize what to create, and each tab links the cloud vendor's own guide for the console-level steps.
57
58**Amazon Bedrock**
59
60Create the trust configuration in your AWS account, following the [AWS guide to creating OIDC identity providers](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_create_oidc.html):
61
62* Add a GitHub OIDC identity provider with provider URL `https://token.actions.githubusercontent.com` and audience `sts.amazonaws.com`
63* Create an IAM role trusted by that provider as a web identity, and attach the scoped invocation policy from [IAM configuration](/docs/en/amazon-bedrock#iam-configuration), which grants `bedrock:InvokeModel`, `bedrock:InvokeModelWithResponseStream`, `bedrock:ListInferenceProfiles`, and `bedrock:GetInferenceProfile`, along with two `aws-marketplace` subscription actions
64* Limit the role's trust policy to your repository with a subject condition such as `repo:your-org/your-repo:*`. See [GitHub's OIDC hardening guide](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect) for the claim format
65
66Note the role's ARN. You add it as a secret in the next step.
67
68**Google Cloud's Agent Platform**
69
70Create the federation resources in your Google Cloud project, following the [Workload Identity Federation documentation](https://cloud.google.com/iam/docs/workload-identity-federation):
71
72* Enable three APIs: IAM Credentials, Security Token Service (STS), and the Agent Platform API, whose service name is `aiplatform.googleapis.com`
73* Create a Workload Identity Pool with a GitHub OIDC provider whose issuer is `https://token.actions.githubusercontent.com`, and add an attribute condition that limits the pool to your repository
74* Create a dedicated service account with only the `Vertex AI User` role, which is `roles/aiplatform.user`, and allow the pool to impersonate it
75
76Note the provider's full resource name and the service account's email address. You add them as secrets in the next step.
77
78**Microsoft Foundry**
79
80Create a Microsoft Entra application with a federated credential for your repository, following [Microsoft's guide to authenticating from GitHub Actions](https://learn.microsoft.com/en-us/azure/developer/github/connect-from-azure-openid-connect):
81
82* Register a Microsoft Entra application and add a federated identity credential that trusts tokens GitHub issues to your repository. A user-assigned managed identity works in place of an application. Both have the client ID you note below
83* Assign the application the `Azure AI User` role on your Foundry resource. See [Azure RBAC configuration](/docs/en/microsoft-foundry#azure-rbac-configuration) for a narrower custom role
84
85Note the application's client ID, your tenant ID, and your subscription ID. You add them as secrets in the next step.
86
87**3. Add repository secrets**
88
89In the repository where the Claude Code GitHub Action runs, add the secrets for your provider, plus the two app secrets if you created a custom GitHub App in the first step. See GitHub's guide to [using secrets in GitHub Actions](https://docs.github.com/en/actions/security-guides/using-secrets-in-github-actions).
90
91| Secret | Needed for | Value |
92| - | - | - |
93| `AWS_ROLE_TO_ASSUME` | Amazon Bedrock | The ARN of the IAM role |
94| `GCP_WORKLOAD_IDENTITY_PROVIDER` | Google Cloud's Agent Platform | The provider's full resource name |
95| `GCP_SERVICE_ACCOUNT` | Google Cloud's Agent Platform | The service account's email address |
96| `AZURE_CLIENT_ID` | Microsoft Foundry | The Entra application's client ID |
97| `AZURE_TENANT_ID` | Microsoft Foundry | Your Microsoft Entra tenant ID |
98| `AZURE_SUBSCRIPTION_ID` | Microsoft Foundry | Your Azure subscription ID |
99| `APP_ID` | Custom GitHub App | The GitHub App's ID |
100| `APP_PRIVATE_KEY` | Custom GitHub App | The contents of the `.pem` private key file |
101
102**4. Create the workflow file**
103
104Create a workflow file for your provider, such as `.github/workflows/claude.yml`. Each example responds to `@claude` mentions, authenticates to GitHub with a custom app, and includes the `id-token: write` permission, which GitHub requires to issue the OIDC token that your cloud provider exchanges for credentials.
105
106If you chose a different GitHub identity in the first step, adjust the example:
107
108* **Official Claude GitHub App**: delete the Generate GitHub App token step and the `github_token` line
109* **GitHub's automatic token**: delete the token-generation step and change the `github_token` line to `github_token: ${{ secrets.GITHUB_TOKEN }}`
110
111> [!WARNING]
112>
113> On public repositories, a comment containing the trigger phrase from any user starts this workflow. The credential steps run before the Claude Code GitHub Action checks the commenter's write access, so the action rejects unauthorized users only after the workflow has generated an App token and signed in to your cloud provider, which leaves audit-log entries and consumes Actions minutes. To avoid those runs, add a step that verifies the commenter's write access before the credential steps.
114
115**Amazon Bedrock**
116
117Replace the `aws-region` value with your own. The credentials step exports it as `AWS_REGION` for the rest of the job.
118
119```yaml theme={null}
120name: Claude PR Action
121
122permissions:
123 contents: write
124 pull-requests: write
125 issues: write
126 id-token: write
127
128on:
129 issue_comment:
130 types: [created]
131 pull_request_review_comment:
132 types: [created]
133 issues:
134 types: [opened]
135
136jobs:
137 claude-pr:
138 if: |
139 (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) ||
140 (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) ||
141 (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')))
142 runs-on: ubuntu-latest
143 steps:
144 - name: Checkout repository
145 uses: actions/checkout@v6
146
147 - name: Generate GitHub App token
148 id: app-token
149 uses: actions/create-github-app-token@v2
150 with:
151 app-id: ${{ secrets.APP_ID }}
152 private-key: ${{ secrets.APP_PRIVATE_KEY }}
153
154 - name: Configure AWS Credentials (OIDC)
155 uses: aws-actions/configure-aws-credentials@v4
156 with:
157 role-to-assume: ${{ secrets.AWS_ROLE_TO_ASSUME }}
158 aws-region: us-west-2
159
160 - uses: anthropics/claude-code-action@v1
161 with:
162 github_token: ${{ steps.app-token.outputs.token }}
163 use_bedrock: "true"
164 claude_args: '--model us.anthropic.claude-sonnet-4-6'
165```
166
167> [!TIP]
168>
169> Bedrock model IDs include a cross-region inference profile prefix such as `us.`. Use the prefix for the region group where you granted model access.
170
171**Google Cloud's Agent Platform**
172
173Replace the `CLOUD_ML_REGION` value with your own. You don't need to hardcode the project ID, because the workflow reads it from the `auth` step's output.
174
175```yaml theme={null}
176name: Claude PR Action
177
178permissions:
179 contents: write
180 pull-requests: write
181 issues: write
182 id-token: write
183
184on:
185 issue_comment:
186 types: [created]
187 pull_request_review_comment:
188 types: [created]
189 issues:
190 types: [opened]
191
192jobs:
193 claude-pr:
194 if: |
195 (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) ||
196 (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) ||
197 (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')))
198 runs-on: ubuntu-latest
199 steps:
200 - name: Checkout repository
201 uses: actions/checkout@v6
202
203 - name: Generate GitHub App token
204 id: app-token
205 uses: actions/create-github-app-token@v2
206 with:
207 app-id: ${{ secrets.APP_ID }}
208 private-key: ${{ secrets.APP_PRIVATE_KEY }}
209
210 - name: Authenticate to Google Cloud
211 id: auth
212 uses: google-github-actions/auth@v2
213 with:
214 workload_identity_provider: ${{ secrets.GCP_WORKLOAD_IDENTITY_PROVIDER }}
215 service_account: ${{ secrets.GCP_SERVICE_ACCOUNT }}
216
217 - uses: anthropics/claude-code-action@v1
218 with:
219 github_token: ${{ steps.app-token.outputs.token }}
220 use_vertex: "true"
221 claude_args: '--model claude-sonnet-5'
222 env:
223 ANTHROPIC_VERTEX_PROJECT_ID: ${{ steps.auth.outputs.project_id }}
224 CLOUD_ML_REGION: us-east5
225```
226
227**Microsoft Foundry**
228
229Replace `your-resource-name` with your Foundry resource name. Claude Code builds the endpoint URL from it. The `azure/login` step signs in with the workflow's OIDC token, and Claude Code picks up the credentials through the Azure [default credential chain](https://learn.microsoft.com/en-us/azure/developer/javascript/sdk/authentication/credential-chains#defaultazurecredential-overview).
230
231```yaml theme={null}
232name: Claude PR Action
233
234permissions:
235 contents: write
236 pull-requests: write
237 issues: write
238 id-token: write
239
240on:
241 issue_comment:
242 types: [created]
243 pull_request_review_comment:
244 types: [created]
245 issues:
246 types: [opened]
247
248jobs:
249 claude-pr:
250 if: |
251 (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) ||
252 (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) ||
253 (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')))
254 runs-on: ubuntu-latest
255 steps:
256 - name: Checkout repository
257 uses: actions/checkout@v6
258
259 - name: Generate GitHub App token
260 id: app-token
261 uses: actions/create-github-app-token@v2
262 with:
263 app-id: ${{ secrets.APP_ID }}
264 private-key: ${{ secrets.APP_PRIVATE_KEY }}
265
266 - name: Authenticate to Azure
267 uses: azure/login@v2
268 with:
269 client-id: ${{ secrets.AZURE_CLIENT_ID }}
270 tenant-id: ${{ secrets.AZURE_TENANT_ID }}
271 subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
272
273 - uses: anthropics/claude-code-action@v1
274 with:
275 github_token: ${{ steps.app-token.outputs.token }}
276 use_foundry: "true"
277 claude_args: '--model claude-sonnet-5'
278 env:
279 ANTHROPIC_FOUNDRY_RESOURCE: your-resource-name
280```
281
282> [!TIP]
283>
284> Use a model ID that matches a Claude deployment in your Foundry resource. See [Claude Code on Microsoft Foundry](/docs/en/microsoft-foundry) for model configuration and version pinning.
285
286With any provider, you can bound run length and cost by adding `--max-turns` to `claude_args`. See [Manage costs](/docs/en/github-actions#manage-costs).
287
288**5. Test the setup**
289
290Mention `@claude` in an issue or PR comment, then watch the run in the repository's Actions tab. Claude replies in a comment on the same issue or PR.
297291
298292## Troubleshooting
299293
300294
No line in this hunk matches that.