Claude Code in CI: claude -p, --bare and GitHub Actions

Try 3 questions on this

Pick an answer to see why each option is right or wrong.

1. Your continuous integration job runs claude -p inside each developer's checkout, and the results differ from machine to machine because some checkouts carry their own hooks, MCP servers and CLAUDE.md files. Every run needs to start from the same state. What's the correct approach to run Claude Code in an automated pipeline?

   Right. In the game that’s Renown for your Claude Code Configuration and Workflows building.

   Not that one: A is right. In the game your Claude Code Configuration and Workflows building would lose a little Renown, and this question would come back later.

   The answerA.Run claude -p --bare, so the job skips auto-discovery of hooks, skills, commands, subagents and MCP servers.--bare is the flag that removes the discovered surface in one move: it "reduce[s] startup time by skipping auto-discovery of hooks, skills, custom commands, subagents, plugins, MCP servers, auto memory, and CLAUDE.md". The docs name this exact use: bare mode "is useful for CI and scripts where you need the same result on every machine", and spell out that a hook in a teammate's ~/.claude or an MCP server in the project's .mcp.json will not run because bare mode never reads them.Your answerB.Run claude -p --allowedTools "Read,Edit" so that the job pre-approves the same tools on any machine.--allowedTools auto-approves tools so a non-interactive run does not stall on a permission prompt. It is worth setting, but it governs what Claude may do, not which of the checkout's hooks, servers and memory files are loaded before it starts.Your answerC.Run claude -p --output-format json so that the job reports its result in one machine-readable shape.--output-format gives you structured output to parse. It changes the shape of the answer, not how the answer was produced, so the machine-to-machine variation survives untouched.Your answerD.Run claude -p --continue so that the job resumes from the same previously recorded session.--continue continues an earlier conversation on that machine. Far from making runs identical, it makes each one depend on whatever the last run on that agent happened to leave behind.

   Written from code.claude.com/docs/en/headless

2. A release script calls claude -p to pull the changed public function names out of a diff, and it needs them as a JSON array rather than prose. You already pass --output-format json and read .result with jq, and the shape of that text changes from run to run, so the parser downstream keeps breaking. What's the most effective way to make the run return a machine-readable list?

   Right. In the game that’s Renown for your Claude Code Configuration and Workflows building.

   Not that one: C is right. In the game your Claude Code Configuration and Workflows building would lose a little Renown, and this question would come back later.

   Your answerA.Switch to --output-format stream-json --verbose and reassemble the array from the streamed events as the run produces them.Changes the delivery of the output rather than its shape. stream-json gives newline-delimited events for real-time consumption; the assistant text inside them is as free-form as before, so the parser has the same problem with more plumbing around it.Your answerB.Keep --output-format json and add a system prompt instructing Claude to answer with JSON only, then go on reading .result.Substitutes an instruction for a contract. Asking for JSON in the prompt is probabilistic, and the script keeps depending on the model's formatting rather than on a validated field, which is the fragility the release script already has.The answerC.Add --json-schema with a schema for the array and read the payload from the response's structured_output field.--output-format json returns a response envelope with metadata such as the session id and usage, and the model's prose in result. Adding --json-schema with a JSON Schema definition puts the structured output in the structured_output field of that envelope, which is the field a script should read.Your answerD.Add --json-schema with a schema for the array and go on reading .result, which the schema now constrains.Right flag, wrong field. --json-schema puts the conforming payload in structured_output; .result continues to carry the run's ordinary text, so the parser reads the same free-form output it reads now.

   Show the full explanation and doc quotes

   The pair turns a formatting request into a contract: if the schema itself is not valid, claude exits with Error: --json-schema is not a valid JSON Schema rather than quietly returning text.

   Written from code.claude.com/docs/en/headless.md

3. Your review script pipes a pull request diff into claude -p, and you want every run to answer as a security engineer hunting vulnerabilities. Claude Code's default instructions still have to apply, and you would rather not keep a copy of them in the script. What's the most effective way to add that instruction?

   Right. In the game that’s Renown for your Claude Code Configuration and Workflows building.

   Not that one: D is right. In the game your Claude Code Configuration and Workflows building would lose a little Renown, and this question would come back later.

   Your answerA.Pass --system-prompt with the security engineer instruction, which replaces Claude Code's default system prompt with what you supply.--system-prompt fully replaces the default prompt. Claude Code's own instructions go with it, so the script would have to carry and maintain a copy of everything it needs back.Your answerB.Pass --append-system-prompt-file with the security engineer instruction inline, which loads the text as though it came from a file.--append-system-prompt-file exists, but it takes a path to a file holding the text. Handing it the instruction itself is the wrong member of the pair.Your answerC.Pass --settings with the security engineer instruction, which merges it into the settings Claude Code loads for this run.--settings passes settings keys as JSON, inline or as a path, for one session. It is not a route for system prompt text.The answerD.Pass --append-system-prompt with the security engineer instruction, which adds it on top of Claude Code's default system prompt.--append-system-prompt is the member of the system prompt family that adds to the default rather than replacing it: "Use --append-system-prompt to add instructions while keeping Claude Code's default behavior."

   Show the full explanation and doc quotes

   The documented example is exactly this shape — gh pr diff "$1" | claude -p --append-system-prompt "You are a security engineer. Review for vulnerabilities." --output-format json.

   Written from code.claude.com/docs/en/headless.md