# Claude Code in CI/CD

Running Claude Code non-interactively in a build pipeline with guardrails on any code it changes.

## Why the CCAR-P exam tests this

Letting an agent commit or modify code in an automated pipeline is high-leverage and high-risk, so the exam probes whether you wrap it in branch protection, human review, and sandboxed execution.

## Definition

**Claude Code in CI/CD** means invoking Claude Code in a **headless, non-interactive** mode — for example triggered by a pull request, an issue label, or a scheduled job — to triage failures, draft fixes, review diffs, or update dependencies without a human at the keyboard. The value is scale; the danger is that an agent now has a path to change your codebase automatically.

The controlling principle is **least privilege plus a human gate**. The agent should run with a scoped token, write to a **branch and open a pull request** rather than pushing to a protected default branch, and execute any code it generates inside a **sandboxed environment** so a hallucinated shell command cannot touch production or exfiltrate secrets. Branch protection rules keep a required human review between the agent's output and merge.

Good pipeline design also makes the agent's work **observable and reversible**: every autonomous change is a reviewable diff, runs the full test and lint suite, and can be reverted like any other commit. "The agent opened a PR that a human approved" is the exam-correct pattern; "the agent pushed straight to main" is the trap.

## Exam trap

Granting the CI agent direct write access to a protected branch or an unsandboxed shell is the wrong answer even when it is faster — autonomous code changes must land as reviewable PRs behind branch protection and run in a sandbox.

## Commonly confused with

- **ai-code-verification-checklist** — The checklist is what a reviewer applies to AI output; CI/CD integration is the pipeline plumbing that routes that output to review in the first place.
- **agent-sdk-vs-api-vs-claude-code** — Claude Code is the surface you run in CI; the Agent SDK is a lower-level way to build a custom pipeline agent — pick by control and maintenance cost.

## Related

- ai-code-verification-checklist
- golden-paths
- agent-sdk-vs-api-vs-claude-code
- skills-distribution

---

Source: Claude Cert Prep — an independent, unofficial CCAR-P study resource (domain P7). Not affiliated with Anthropic.