3.6 — CI/CD Integration

CCAR-F Domain 3 · Task 3.6

What You Need to Know

In CI/CD, Claude Code runs headless (no keyboard). Key patterns:

The -p Flag: Non-Interactive Mode

# WRONG — hangs in CI
claude "Analyse this pull request for security issues"

# CORRECT
claude -p "Analyse this pull request for security issues"

Key Concept: For CLI calls in CI, use claude -p. Logs showing Claude waiting for input mean the flag is missing.

Structured Output for CI

claude -p \
  --output-format json \
  --json-schema '{"type":"object","properties":{"findings":{"type":"array",...}}}' \
  "Review this PR for security issues"

Extract with jq '.structured_output'.

Session Context Isolation

Generate code in one session; review in a separate independent session. A review in the same session is biased by the reasoning that produced the code.

Incremental Review Context

Include prior findings and ask for only new or still-unaddressed issues. Prevents duplicate comments that erode trust.

CLAUDE.md for CI Context

CI reads project CLAUDE.md the same way interactive sessions do. Use it for testing standards, fixtures, review criteria, coverage targets.

Key CLI Flags for Headless Runs

Flag	Effect
-p / --print	Non-interactive
--output-format json	Machine-parseable envelope
--json-schema	Schema-validated structured output
--append-system-prompt	Add rules without replacing default prompt
--allowedTools	Tools that run without permission prompt
--max-turns	Cap agentic turns
--bare	Skip auto-discovery of hooks, skills, MCP, CLAUDE.md

GitHub Actions

anthropics/claude-code-action@v1 runs Claude Code non-interactively. Pass CLI flags via claude_args. With a prompt it runs in automation mode; without, it waits for @claude mentions.

Exam Traps

• Running without -p in CI (hangs)
• Reviewing generated code in the same session that produced it
• Re-reporting all previous findings on every push
• Putting secrets as literals in workflow files