68  68. AI in the Pull Request Workflow

Pull Requests and Code Review showed the GitHub Flow and how teammates review each other’s work. This page shows how Claude Code can open pull requests for you, review code, and work directly on GitHub. You stay responsible for what gets merged.

68.1 Asking Claude Code to open a pull request

As of Oct 6, 2026 · Official docs: Common workflows: Create pull requests · Best practices

Claude Code can do steps 1-4 of the GitHub Flow for you. The docs suggest asking it directly (“create a pr for my changes”) or step by step:

summarize the changes I've made to the authentication module
create a pr
enhance the PR description with more context about the security improvements

Install the GitHub CLI and sign in (gh auth login); the docs note that Claude knows how to use gh to open pull requests, create issues, and read comments. Review the pull request Claude wrote before you ask anyone to review it, and ask Claude to point out potential risks. To find the Claude Code session that created a pull request later, run claude --from-pr 2 (with your PR number); it lists the sessions linked to that pull request so you can resume one.

68.2 Reviewing code with /code-review

As of Oct 6, 2026 · Official docs: Code Review: Review a diff locally · Find bugs with ultrareview · Commands

Inside a Claude Code session:

  • /code-review reviews your branch’s commits plus any uncommitted changes for correctness bugs. It runs in the background and reports its findings in your conversation. Pass a pull request number to review a teammate’s PR (/code-review 2). You can also add an effort level from low (only the findings it is most confident about) to max (broader coverage), --fix to apply the findings to your files, or --comment to post them as comments on the GitHub pull request. /review is another name for the same command.
  • /code-review ultra runs a deeper review in the cloud (called ultrareview): a group of reviewer agents that verify each finding, taking roughly 5 to 10 minutes. It needs a claude.ai account; Pro and Max accounts get 3 free runs (a one-time allowance), after which each review is billed separately as usage credits.
  • /security-review checks your branch’s changes for security problems.

An AI reviewer is a useful second reader, especially for code an AI wrote, but it doesn’t replace a human review: someone on the team should still read and approve the pull request.

68.3 Claude on GitHub: @claude and automatic reviews

As of Oct 6, 2026 · Official docs: Claude Code GitHub Actions · Code Review

  • Claude Code GitHub Actions. Running /install-github-app in Claude Code (you need admin access to the repository and a signed-in gh) installs the Claude GitHub App, stores a credential as a repository secret, and prepares a pull request that adds the workflow file. After you merge it, anyone with write access can mention @claude in an issue or pull request comment, for example @claude fix the TypeError in the user dashboard component, and Claude works on it and replies in the comment. Each run uses GitHub Actions minutes plus either API tokens or your Claude subscription.
  • Code Review. A managed service (research preview, for Team and Enterprise plans) that reviews pull requests automatically and posts findings as comments on the changed lines, marked Important, Nit, or Pre-existing. It never approves or blocks a pull request. Commenting @claude review on a pull request requests a review. It is billed separately from the plan (the docs say reviews average $15-25 each). On other plans, use /code-review locally.

68.4 Key takeaways

  • Claude Code can open pull requests for you (“create a pr”) using the GitHub CLI, gh. Read the pull request it wrote before you ask a teammate to review it.
  • /code-review reviews your branch (or a pull request, with its number) for bugs; /code-review ultra runs a deeper review in the cloud; /security-review looks for security problems.
  • On GitHub, @claude in a comment asks Claude to work on an issue or pull request (after /install-github-app), and the managed Code Review service reviews pull requests automatically.
  • AI reviews are a second reader, not a replacement: a person still reads and approves the pull request and stays responsible for what is merged.

Practice Questions

Easy

Question 1 · Multiple choice

Which tool does Claude Code use to open pull requests, create issues, and read comments on GitHub?

  1. git push
  2. The GitHub CLI, gh
  3. /security-review
  4. The Files changed tab

b. Claude knows how to use gh, so install the GitHub CLI and sign in with gh auth login first. git push (a) only uploads commits, /security-review (c) checks changes for security problems, and the Files changed tab (d) is where people read a pull request’s diff on github.com.

Question 2 · Matching

Match each command with what it does.

Command What it does
1. /code-review A. Checks your branch’s changes for security problems
2. /code-review ultra B. Installs the Claude GitHub App so people can mention @claude on GitHub
3. /security-review C. Reviews your branch’s changes for correctness bugs, in your session
4. /install-github-app D. Runs a deeper review in the cloud with a group of reviewer agents

1 → C, 2 → D, 3 → A, 4 → B.

Question 3 · True or false

If /code-review finds no problems in your pull request, nobody else needs to review it.

False. An AI reviewer is a useful second reader, but it doesn’t replace a human review. Someone on the team should still read and approve the pull request, and the team stays responsible for what is merged.

Question 4 · True or false

The managed Code Review service can block a pull request so that it can’t be merged.

False. Code Review posts its findings as comments on the changed lines (marked Important, Nit, or Pre-existing), but it never approves or blocks a pull request. The decision to merge stays with the people on the team.

Medium

Question 5 · Short answer

In a Claude Code session, what does /code-review review by default, and how do you make it review pull request 2 instead?

By default it reviews your current branch’s commits (those not yet on the branch’s upstream) plus any uncommitted changes, looking for correctness bugs. To review pull request 2, pass its number: /code-review 2.

Question 6 · Write the command

Sam wants Claude Code to review his teammate’s pull request 7 and post the findings as comments on the pull request on GitHub. What does he type in his Claude Code session?

/code-review 7 --comment

The number chooses the pull request, and --comment posts the findings on GitHub instead of only reporting them in the conversation. (/review is another name for /code-review.)

Question 7 · Short answer

Last week Maria asked Claude Code to create pull request 12. Now a reviewer has asked for changes, and she wants to continue in the Claude Code session that created it. What command helps her find that session?

claude --from-pr 12. It lists the Claude Code sessions linked to pull request 12, so she can resume one and ask Claude to make the requested changes.

Question 8 · Multiple choice

Sam’s /code-review runs report many findings, and several turn out to be false alarms. Which effort level should he add to see only the findings the review is most confident about?

  1. low
  2. medium
  3. max
  4. ultra

a. At low, the review reports only the findings it is most confident about. Higher levels up to max (b, c) broaden coverage and report more. ultra (d) is not an effort level: it runs the deeper cloud review (ultrareview), which takes longer and costs extra after the free runs.

Question 9 · Scenario

For each situation, name the tool from this page that fits best:

  1. Maria wants a quick check of her branch for bugs before she opens a pull request.
  2. Sam is about to merge a large, risky change and wants the deepest review available, even if it takes several minutes.
  3. Maria changed the sign-in code and is worried about security problems.
  4. A teammate wants to write a comment in a GitHub issue asking Claude to fix the bug described there.
  1. /code-review in her Claude Code session.
  2. /code-review ultra (ultrareview), which runs in the cloud and takes roughly 5 to 10 minutes.
  3. /security-review.
  4. Claude Code GitHub Actions: once installed (for example with /install-github-app), anyone with write access can write @claude ... in an issue or pull request comment.

Question 10 · Ordering

Put these steps in order so that the team can mention @claude in pull request comments:

  • A. Merge the pull request that adds the workflow file
  • B. Sign in to the GitHub CLI with gh auth login
  • C. A teammate writes @claude and a request in a pull request comment
  • D. Run /install-github-app in Claude Code

B → D → A → C. /install-github-app needs a signed-in gh (and admin access to the repository). It installs the Claude GitHub App, stores a credential as a repository secret, and prepares a pull request with the workflow file. Only after that pull request is merged does @claude work in comments.

Hard

Question 11 · Scenario

You asked Claude Code to “create a pr” for your changes, and it did. What should you do before asking a teammate to review it, and how could AI review tools help without replacing your teammate?

Read the pull request yourself: check the description matches what actually changed, look at the diff, run the code, and make sure nothing secret or unrelated was included; ask Claude to point out risks. You can run /code-review (or /code-review ultra for a deeper cloud review, at extra cost after the free runs) to catch bugs before the human review. The AI findings help, but they don’t approve anything - a teammate still reads and approves the pull request, and the team stays responsible for what is merged.

Question 12 · Compare

Compare Claude Code GitHub Actions (@claude) with the managed Code Review service: what does each do, who can use it, and how is it paid for?

  • GitHub Actions (@claude): a workflow you install in your repository (for example with /install-github-app). When someone with write access mentions @claude in an issue or pull request comment, Claude works on the request (answers questions, changes code, pushes commits) and replies in a comment. It uses GitHub Actions minutes plus API tokens or your Claude subscription.
  • Code Review: a managed service (research preview for Team and Enterprise plans) that automatically reviews pull requests and posts findings on the changed lines (Important, Nit, Pre-existing), without approving or blocking. It is billed separately per review (averaging $15-25 according to the docs). Individual Pro or Max users can use /code-review locally instead.

Question 13 · Long answer

A teammate proposes: “Claude writes most of our code and /code-review checks it, so we can stop doing human reviews and merge as soon as the AI review is clean.” Give two reasons this is a bad idea, and describe a better process that still uses the AI tools.

Reasons (any two):

  • An AI reviewer is a second reader, not a replacement. A review with no findings doesn’t prove the code is correct or secure.
  • AI-written code often looks polished even when it is wrong, so it needs a careful human reader, not less review.
  • A person, not the AI, is responsible for what is merged. Someone on the team has to understand the change and decide to approve it.

A better process: the author (or Claude) opens the pull request; the author reads it and runs /code-review (and /security-review for risky changes) and fixes what it finds; then a teammate reads, runs and approves the pull request before it is merged. A good answer keeps the AI tools as an early, quick check and keeps a human approval as the final step.

© 2025-2026 Y. Rosenthal. All rights reserved.