Running AI Coding Agents in CI/CD: Claude Code, Codex, and Gemini CLI in Headless Mode

# Print mode — runs a single prompt, outputs result, exits
claude -p "Analyze the git diff and generate a changelog entry" \
  --allowedTools Edit,Write,Bash \
  --output-format json

# With stdin piping
git diff HEAD~1 | claude -p "Generate a changelog entry for these changes" \
  --output-format text

# With max tokens to control cost
claude -p "Fix the failing test in tests/auth.test.ts" \
  --allowedTools Edit,Read,Bash \
  --max-turns 10

# Full auto mode — no human approval needed
codex --approval-mode full-auto \
  --quiet \
  "Update the README with the latest API changes"

# With file restrictions
codex --approval-mode full-auto \
  --quiet \
  --full-auto-error-mode ask-user \
  "Add input validation to the user registration endpoint"

# Non-interactive with prompt
echo "Generate unit tests for src/utils/validator.ts" | gemini

# With sandbox mode
gemini -s "Review the last commit for security issues" \
  --sandbox

name: Generate Changelog

on:
  push:
    tags: ['v*']

jobs:
  changelog:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Install Claude Code
        run: npm install -g @anthropic-ai/claude-code

      - name: Generate changelog entry
        env:
          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
        run: |
          PREV_TAG=$(git describe --tags --abbrev=0 HEAD~1 2>/dev/null || echo "")
          DIFF=$(git log ${PREV_TAG}..HEAD --oneline --no-merges)

          echo "$DIFF" | claude -p "Generate a changelog entry in Keep a Changelog format. Group changes into Added, Changed, Fixed, Removed. Be concise — one line per change. Output only the changelog markdown, nothing else." \
            --output-format text > CHANGELOG_ENTRY.md

      - name: Create release with changelog
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          gh release create ${{ github.ref_name }} \
            --title "${{ github.ref_name }}" \
            --notes-file CHANGELOG_ENTRY.md

name: AI Code Review

on:
  pull_request:
    types: [opened, synchronize]

jobs:
  ai-review:
    runs-on: ubuntu-latest
    permissions:
      pull-requests: write
      contents: read
    steps:
      - uses: actions/checkout@v4

      - name: Install Claude Code
        run: npm install -g @anthropic-ai/claude-code

      - name: Run AI review
        env:
          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
        run: |
          DIFF=$(gh pr diff ${{ github.event.pull_request.number }})

          REVIEW=$(echo "$DIFF" | claude -p "Review this diff for:
          1. Security issues (SQL injection, XSS, hardcoded secrets)
          2. Missing error handling
          3. Performance concerns (N+1 queries, unnecessary loops)
          4. Missing input validation

          Format as a markdown list. If no issues found, say 'No issues found.' Be specific — reference file names and line numbers." \
            --output-format text \
            --max-turns 3)

          gh pr comment ${{ github.event.pull_request.number }} \
            --body "## AI Code Review

          $REVIEW

          ---
          *Automated review by Claude Code. This is advisory — human review is still required.*"

name: Tests with Auto-Fix

on:
  pull_request:

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ github.head_ref }}

      - uses: actions/setup-node@v4
        with:
          node-version: 20

      - run: npm ci
      - name: Run tests
        id: tests
        continue-on-error: true
        run: npm test 2>&1 | tee test-output.txt

      - name: AI fix attempt
        if: steps.tests.outcome == 'failure'
        env:
          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
        run: |
          npm install -g @anthropic-ai/claude-code

          claude -p "The tests failed. Here's the output:

          $(cat test-output.txt)

          Read the failing test files and the source code they test.
          Fix the source code to make the tests pass.
          Do NOT modify the test files — fix the implementation." \
            --allowedTools Read,Edit,Bash \
            --max-turns 15

      - name: Verify fix
        if: steps.tests.outcome == 'failure'
        run: npm test

      - name: Commit fix
        if: steps.tests.outcome == 'failure'
        run: |
          git config user.name "AI Agent"
          git config user.email "ai-agent@deployhq.com"
          git add -A
          git diff --staged --quiet || git commit -m "fix: auto-fix failing tests (AI-generated)"
          git push

name: Security Scan + AI Triage

on:
  pull_request:

jobs:
  security:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Run Semgrep
        run: |
          pip install semgrep
          semgrep --config auto --json --output semgrep-results.json . || true

      - name: AI triage
        env:
          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
        run: |
          npm install -g @anthropic-ai/claude-code

          TRIAGE=$(claude -p "Here are Semgrep security scan results:

          $(cat semgrep-results.json)

          Triage these findings:
          1. Remove false positives (explain why)
          2. Rank remaining issues by severity (Critical, High, Medium, Low)
          3. For each real issue, explain the attack vector in one sentence
          4. Suggest a fix for Critical and High issues

          Format as a markdown table." \
            --output-format text \
            --max-turns 3)

          echo "$TRIAGE" >> $GITHUB_STEP_SUMMARY

name: Auto-Generate Tests

on:
  pull_request:

jobs:
  generate-tests:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ github.head_ref }}

      - uses: actions/setup-node@v4
        with:
          node-version: 20

      - run: npm ci

      - name: Install Claude Code
        run: npm install -g @anthropic-ai/claude-code

      - name: Generate tests for changed files
        env:
          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
        run: |
          CHANGED=$(gh pr diff ${{ github.event.pull_request.number }} --name-only | grep -E '\.(ts|js)$' | grep -v test | grep -v spec)

          for FILE in $CHANGED; do
            TEST_FILE=$(echo "$FILE" | sed 's/\.ts$/.test.ts/' | sed 's|src/|tests/unit/|')

            if [ ! -f "$TEST_FILE" ]; then
              claude -p "Read $FILE and generate a comprehensive unit test file.
              Use Vitest. Follow the existing test patterns in the project.
              Save the test file to $TEST_FILE.
              Test all exported functions including edge cases." \
                --allowedTools Read,Write \
                --max-turns 10
            fi
          done

      - name: Verify tests pass
        run: npm test

      - name: Commit generated tests
        run: |
          git config user.name "AI Agent"
          git config user.email "ai-agent@deployhq.com"
          git add tests/
          git diff --staged --quiet || git commit -m "test: add AI-generated tests for new code"
          git push

ai-review:
  stage: review
  image: node:20
  script:
    - npm install -g @anthropic-ai/claude-code
    - git diff origin/main...HEAD | claude -p "Review this diff for bugs and security issues" --output-format text > review.md
    - cat review.md
  artifacts:
    reports:
      dotenv: review.md
  variables:
    ANTHROPIC_API_KEY: $ANTHROPIC_API_KEY

pipelines:
  pull-requests:
    '**':
      - step:
          name: AI Code Review
          image: node:20
          script:
            - npm install -g @anthropic-ai/claude-code
            - git diff origin/main...HEAD | claude -p "Review for security issues" --output-format text

- name: Deploy to Staging
  if: success()
  run: |
    curl -fsSL https://www.deployhq.com/install-cli.sh | bash
    dhq auth login --token "${{ secrets.DEPLOYHQ_API_KEY }}"
    dhq deploy --server staging --wait --json