Skip to content
Sign in
Artwork for OCDevel Claude Code
OCDevel Claude Code · June 25

Label-Driven Runs: Trigger a Claude Code Implement Pass From a GitHub Label

Apply one named label to an issue and Claude Code runs an unattended implement pass that pushes a branch and opens a PR. The label gates who can fire it, not who wrote the issue body, so the spec you splice into the prompt is still attacker-controllable and you must treat it as data. Episode page & show notes Visit website A hands-on tutorial on wiring anthropics/claude-code-action so that applying a GitHub label kicks off an implement pass with no @claude mention. Plus the week's Claude Code news. News (June 21-25, 2026) claude-code-action: v1.0.157, v1.0.156 (June 24), v1.0.155 (June 23). Merged fixes per the releases page: filter PR reviews/inline comments to trigger time (#1385), allow @ in branch names (#1411), format-turns content-type fallback tests (#1421). Bump to v1.0.157. CLI v2.1.191 (June 24): new /rewind to recover a session cleared with /clear; stopped background agents stay stopped; comma-separated hook matchers fixed; MCP retry logic; ~37% lower streaming CPU. CLI v2.1.187 (June 23): new sandbox.credentials setting blocks sandboxed commands from reading secrets, org model restrictions, remote MCP 5-min idle timeout (CLAUDE_CODE_MCP_TOOL_IDLE_TIMEOUT), /install-github-app workflow setup now optional. Billing: the planned move of Agent SDK / Claude Code usage onto a separate credit is NOT taking effect; being reworked with advance notice. Tutorial: label as the trigger GitHub fires a labeled activity on the issues event. Use on: issues: types: [labeled] and gate with if: github.event.label.name == 'claude-implement' — without the if, every label burns a run. See Events that trigger workflows. Two gates: the action's label_trigger: "claude" input, or workflow-level types: [labeled] + an if. v1 auto-detects automation mode when you set an explicit prompt. v1 consolidated inputs: direct_prompt/override_prompt/mode → prompt; model/max_turns/allowed_tools/custom_instructions → claude_args. Pin @v1, not @beta. Known bug #210: early label_trigger failed on a missing LABEL_TRIGGER env mapping. PRs aren't auto-created (per the action's security docs): Claude pushes a branch and links the PR page. Wire gh pr create yourself. GITHUB_TOKEN can't fire downstream workflows (docs, #25565): a default-token PR won't start CI, and a bot-applied label won't fire the labeled workflow. Use actions/create-github-app-token@v2. Label as a state machine: claude-implement → remove first, add claude-working → claude-done/needs-human. Idempotent + a concurrency group keyed on issue.number. See gh issue edit. The pitfall: splicing issue.body into the prompt is the lethal-trifecta injection surface. The label gates who labels, not who wrote the body. Gate authors, treat body as data, shrink blast radius. Cron alternative: poll with gh issue list --label, run headless claude -p. See the GitHub Actions docs.

0:00Duration unknown
Play in

transcript

No transcript — this publisher did not publish one.

show notes

Apply one named label to an issue and Claude Code runs an unattended implement pass that pushes a branch and opens a PR. The label gates who can fire it, not who wrote the issue body, so the spec you splice into the prompt is still attacker-controllable and you must treat it as data.

Episode page & show notes

Visit website

A hands-on tutorial on wiring anthropics/claude-code-action so that applying a GitHub label kicks off an implement pass with no @claude mention. Plus the week's Claude Code news.

News (June 21-25, 2026)

  • claude-code-action: v1.0.157, v1.0.156 (June 24), v1.0.155 (June 23). Merged fixes per the releases page: filter PR reviews/inline comments to trigger time (#1385), allow @ in branch names (#1411), format-turns content-type fallback tests (#1421). Bump to v1.0.157.
  • CLI v2.1.191 (June 24): new /rewind to recover a session cleared with /clear; stopped background agents stay stopped; comma-separated hook matchers fixed; MCP retry logic; ~37% lower streaming CPU.
  • CLI v2.1.187 (June 23): new sandbox.credentials setting blocks sandboxed commands from reading secrets, org model restrictions, remote MCP 5-min idle timeout (CLAUDE_CODE_MCP_TOOL_IDLE_TIMEOUT), /install-github-app workflow setup now optional.
  • Billing: the planned move of Agent SDK / Claude Code usage onto a separate credit is NOT taking effect; being reworked with advance notice.

Tutorial: label as the trigger

  • GitHub fires a labeled activity on the issues event. Use on: issues: types: [labeled] and gate with if: github.event.label.name == 'claude-implement' — without the if, every label burns a run. See Events that trigger workflows.
  • Two gates: the action's label_trigger: "claude" input, or workflow-level types: [labeled] + an if. v1 auto-detects automation mode when you set an explicit prompt.
  • v1 consolidated inputs: direct_prompt/override_prompt/mode → prompt; model/max_turns/allowed_tools/custom_instructions → claude_args. Pin @v1, not @beta. Known bug #210: early label_trigger failed on a missing LABEL_TRIGGER env mapping.
  • PRs aren't auto-created (per the action's security docs): Claude pushes a branch and links the PR page. Wire gh pr create yourself.
  • GITHUB_TOKEN can't fire downstream workflows (docs, #25565): a default-token PR won't start CI, and a bot-applied label won't fire the labeled workflow. Use actions/create-github-app-token@v2.
  • Label as a state machine: claude-implement → remove first, add claude-working → claude-done/needs-human. Idempotent + a concurrency group keyed on issue.number. See gh issue edit.
  • The pitfall: splicing issue.body into the prompt is the lethal-trifecta injection surface. The label gates who labels, not who wrote the body. Gate authors, treat body as data, shrink blast radius.
  • Cron alternative: poll with gh issue list --label, run headless claude -p. See the GitHub Actions docs.
links14

more episodes

All episodes