Most people only use Claude Code interactively. But the same CLI has a headless mode: claude -p "<prompt>" runs one prompt, prints the answer, and exits. That makes it a normal script step you can drop into CI or a git hook.
git diff origin/main...HEAD | claude -p "Review this diff. List real bugs only. If there are none, print exactly: LGTM" --output-format text
Piped stdin becomes context, -p runs non-interactively, and the output is plain text you can grep.
#!/usr/bin/env bash
set -euo pipefail
out=$(git diff origin/main...HEAD | claude -p \
"Review this diff for bugs, missing error handling and leaked secrets. If nothing is wrong, reply with exactly LGTM." \
--allowedTools "Read,Grep" --max-turns 3)
echo "$out"
[[ "$out" == "LGTM" ]] || exit 1
--allowedTools "Read,Grep" keeps the CI run read-only: it can look at files but not edit or run shell commands.--max-turns 3 caps how long it can wander.--output-format json and parse .result with jq.
- name: Claude review
env:
ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
run: |
npm i -g @anthropic-ai/claude-code
./scripts/claude-review.sh
Keep the key in repository secrets, never in the script.
CLAUDE.md and .claude/settings.json still load in headless mode, so your house rules apply in CI too.continue-on-error: true) for a week before you let it fail builds.
I keep copy-ready Claude Code configs (CLAUDE.md templates, slash commands, hooks, permission rules) in Vildanden Agent Config. There's a free sample: https://justly-mia-429.rehost.page/