# Your CI review agent, now through Context Mode November 1, 2026 CI 8 min read Thanks to the Anthropic team for `claude-code-action`, and to GitHub for Actions. Together they let Claude review every pull request. Today that review can run through Context Mode with two Context Mode commands, after one sign-in. One writes the workflow. One makes a CI key and stores it as a GitHub secret, with no browser and no key on screen. The CI turns get savings on large tool output. They do not get your personal memory, your writing style or the status line, and they stay apart from your own sessions. ## TL;DR - **Write the workflow:** `npx @context-mode/cli ci init` writes `.github/workflows/context-mode-review.yml`. `anthropics/claude-code-action@v1` reviews each PR and posts one comment. - **Make the key:** `npx @context-mode/cli ci key create --repo owner/name --gh` makes a CI key and stores it as the secret `CONTEXT_MODE_KEY`. It never shows on screen. - **The action's own secret stays:** the repo also needs `ANTHROPIC_API_KEY`, as `claude-code-action` needs today. - **What it saves:** 24% to 34% lower cost per run on 4 CI jobs (Sonnet 5.5, 2026-11-01). [Results](#results). - **What CI turns get:** savings on large tool output, and a scope per repo and PR. - **What they do not get:** your personal memory, your writing style, your Skills and Instructions, or the status line in the review. ## How to add an AI PR review to GitHub Actions This post answers one question: how do you add an AI PR review to GitHub Actions through Context Mode? Five steps, all in your terminal, inside the repository. Pick a step to see the exact command and what it prints. Step Sign in Workflow CI key Model key Push ``` $ npx @context-mode/cli login Opened your browser. Finish signing in there. Waiting… Signed in as . # … # in a terminal, it then shows the agent picker for the apps on this machine ``` Do this once. It uses your Claude Code or Codex login to sign in, and stores a device key for this terminal. The CI key in step 3 is made with this device key, so no browser opens there. ``` $ cd your-repo $ npx @context-mode/cli ci init Wrote .github/workflows/context-mode-review.yml: Claude reviews each pull request through Context Mode. Add one secret to owner/name: CONTEXT_MODE_KEY. npx @context-mode/cli ci key create --repo owner/name --gh (--gh stores it with the GitHub CLI and never shows it. Without --gh the key is printed once; add it at https://github.com/owner/name/settings/secrets/actions) The workflow also uses ANTHROPIC_API_KEY, your Anthropic key, as claude-code-action does today. Then commit and push the file. ``` The file holds no key. `--dry-run` prints it and writes nothing. ``` $ npx @context-mode/cli ci key create --repo owner/name --gh Created CI key "CI owner/name" for owner/name. Expires . Stored as the secret CONTEXT_MODE_KEY in owner/name with the GitHub CLI. It was not shown. Revoke it any time on https://console.contextmode.ai under Profile > Devices. ``` `--gh` pipes the key into `gh secret set`. Without it, the key prints once and is never written to disk. ``` $ gh secret set ANTHROPIC_API_KEY --repo owner/name # paste your Anthropic API key when asked # or: Settings > Secrets and variables > Actions ``` The action's own secret, set the GitHub way, with the same `gh secret set` form the CLI prints. Context Mode never writes it. ``` $ git add .github/workflows/context-mode-review.yml && git commit -m "Claude PR review" && git push # open a pull request: the review comment follows ``` The next PR you open, push to or mark ready gets one review comment. ### 1. The native parts stay native Nothing here replaces GitHub's or Anthropic's way. The review is `anthropics/claude-code-action@v1`, as its makers ship it. It reads your Anthropic key from the `ANTHROPIC_API_KEY` secret, as it does today. The CI key goes in with the GitHub CLI, `gh`, signed in to your account. Context Mode adds a few lines to one workflow file, and one secret. ### 2. Write the workflow ``` npx @context-mode/cli ci init # writes .github/workflows/context-mode-review.yml ``` It writes at the repository root, wherever you run it. If a different file is already at that path, it keeps yours and stops (exit 3). `--force` replaces it. Run it again with nothing to change, and it writes nothing. ### 3. Make the CI key without a browser ``` npx @context-mode/cli ci key create --repo owner/name --gh # makes a CI key and stores it as the CONTEXT_MODE_KEY secret ``` - `--repo owner/name`: the repository the key is for. Default: the GitHub `origin` remote of this folder. - `--expires DAYS`: 1 to 365. Default: 90. - `--label NAME`: the name on the console. Default: `CI owner/name`. - `--gh`: stores the key with `gh secret set CONTEXT_MODE_KEY`, so it never shows on screen. The gateway returns the key once and stores only its hash. A CI key cannot make other keys. Revoke it on the [Console](https://console.contextmode.ai) under Profile > Devices. ### 4. Commit, push, open a PR ``` git add .github/workflows/context-mode-review.yml && git commit -m "Claude PR review" && git push ``` ## What ci init writes The Context Mode lines sit in one marked block, in the job's `env`. Here are those lines as `ci init` writes them, with the comments cut: ``` env: # --- Context Mode: start --------------------------------------------- ANTHROPIC_BASE_URL: https://gateway.contextmode.ai ANTHROPIC_CUSTOM_HEADERS: | x-cm-device-key: ${{ secrets.CONTEXT_MODE_KEY }} x-context-mode-banner: off x-cm-ci-repo: ${{ github.repository }} x-cm-ci-ref: pr-${{ github.event.pull_request.number }} x-cm-ci-run: ${{ github.run_id }} ENABLE_TOOL_SEARCH: "true" # --- Context Mode: end ----------------------------------------------- ``` The rest is a plain review job: - **When it runs:** a PR is opened, gets a new push, or is marked ready for review. Draft PRs are skipped. - **Fork PRs are skipped**, because GitHub gives them no secrets. The job skips them instead of failing. - **One review per PR at a time.** A new push cancels the old review. - **Small permissions:** `contents: read` and `pull-requests: write`. - **Small tool list:** the agent may run `git diff`, `git log`, `gh pr diff` and `gh pr comment`, and read and search files (`Read`, `Grep`, `Glob`). Nothing else. - **The prompt asks for real problems only:** bugs, missing tests, security issues, breaking changes, each with the file, the line and a one-line fix. One comment. If it finds nothing, it says so in one line. The prompt is yours to change. It is plain YAML in your repo. ## What it saves, measured We ran Claude Code headless in GitHub Actions on real tasks from popular repositories, direct to Anthropic and through Context Mode. Same agent, same prompt, same model. The table counts warm runs, as a repo reruns a job every few minutes. | CI job | Context Mode | Direct | Lower | 95% range | Saved per 1,000 runs | | --- | --- | --- | --- | --- | --- | | CI-failure fix | $0.0281 | $0.0442 | 33.9% | 25.1 to 43.6% | $16 | | Issue triage and labels | $0.0183 | $0.0262 | 29.6% | 21.1 to 38.8% | $8 | | Release notes | $0.0987 | $0.1333 | 25.7% | 7.2 to 42.7% | $35 | | @claude fix (issue to PR) | $0.0736 | $0.0902 | 23.7% | 11.4 to 35.7% | $17 | Method, 95% ranges and the rows we left out: [Benchmarks](https://contextmode.ai/docs/benchmarks#ci-headless). Run the same jobs in your own repo, with your own key: [use the lab template](https://github.com/mksglu/cm-ci-lab/generate). ## Why a CI run costs less - **The next run reads the cache.** Each CI run used to rewrite the same prompt prefix, because a per-run git status block came first. The gateway moves that block behind the stable part, with its text unchanged, so run N+1 reads what run N wrote. - **A smaller fixed prefix.** The tool list, system text and skill lists get shorter. The first request is 30% to 42% smaller. - **Cache life per repo.** One hour when the repo reruns the job often, five minutes when it does not. - **Repeated output once.** A block already sent in the same request becomes a one-line pointer. The first copy stays whole. - **Large results folded.** A large tool result keeps its head and tail, and the agent can read the middle back. The gateway does not change the model's answer or its thinking. That is why the saving differs per job. ## Does claude-code-action work with a gateway? Yes. The action runs Claude Code, and Claude Code reads `ANTHROPIC_BASE_URL` and `ANTHROPIC_CUSTOM_HEADERS` from the environment. Context Mode uses only those two, plus `ENABLE_TOOL_SEARCH`, which turns tool search back on for a non-Anthropic base URL. There is no fork of the action and no wrapper. The gateway strips every `x-cm-*` header before it forwards the request, so `CONTEXT_MODE_KEY` never reaches Anthropic. Your `ANTHROPIC_API_KEY` goes on to Anthropic as it is. ## What a CI turn gets, and what it does not A review bot is not you. Its answer goes into a PR that your whole team reads. So the gateway treats a CI turn in a different way from your own sessions. Pick a feature to see what happens in CI. Feature Saving Memory Skills Instructions Protect Status line ``` $ git diff origin/main # a long diff, a big log, a large file # the model gets the part it needs # the rest stays out of its context ``` Yes. CI turns get savings on large tool output. This post gives no number for CI yet. ``` Your rules, decisions, style, chat memory: not sent to a CI turn Scope of a CI turn: project github:owner/name ref pr- ``` The CI key is yours, but the review does not speak as you. No personal memory goes in, and a CI turn writes no personal fact back. ``` Your imported skills: off in CI The review follows the prompt in the workflow file. ``` Skills stay for your own sessions. The CI job does what its YAML says, the same on every run. ``` // Console: Settings → Instructions Keep answers short. No wall of text. # CI turn: not added ``` Your standing instructions shape your own sessions, not the team's PR comments. Put review rules in the workflow prompt. ``` $ git push origin main # Claude Code, Codex on your machine: blocked by your rule ``` In CI, the workflow itself keeps the agent to a short tool list. ``` Example review comment on a PR: src/quota.ts:42 missing null check on plan. Fix: return early when plan is undefined. # no "⏺ contextmode" line in the comment ``` Headless runs get no status line, and the workflow also sends `x-context-mode-banner: off`. The PR comment holds only the review. | Feature | In a CI turn | | --- | --- | | [Saving](https://contextmode.ai/docs/how-saving-works) | Yes, on large tool output | | [Memory](https://contextmode.ai/docs/memory) (yours) | No. A scope per repo and PR instead | | [Recall](https://contextmode.ai/docs/recall) and [Search](https://contextmode.ai/docs/search) of your archive | No. The tools that read your memory are not offered | | [Skills](https://contextmode.ai/docs/skills) | No | | [Instructions](https://contextmode.ai/docs/instructions) and writing style | No | | "⏺ contextmode" line | No, by design | ## Memory in CI: the repo's scope, not yours A CI key is a device key like any other. Without care, a CI answer would carry the key holder's own rules and style into a team PR. So the workflow tells the gateway which repo, PR and run sent each request (`x-cm-ci-repo`, `x-cm-ci-ref`, `x-cm-ci-run`). The gateway then: - gives the turn the project `github:owner/name` and the PR as its ref, not a folder on your machine, - adds none of your rules, style, core memory, chat memory or skills, - does not offer the tools that read your memory, so the model cannot pull it in by a tool call, - writes no personal fact from the turn, - tags each turn with the repo, the PR and the run, so CI work stays apart from your own sessions. Your own sessions in [Claude Code, Codex and the other apps](https://contextmode.ai/blog/seven-coding-agents-one-gateway) keep their Memory as before. ## Tips - **You still need `ANTHROPIC_API_KEY`** as a repo secret. Your Anthropic key pays for the model calls, as with the action today. - **Fork PRs and drafts are skipped.** GitHub gives fork PRs no secrets. - **CI turns get no personal memory, style, Skills, Instructions or status line.** That is on purpose. ## How to undo it Delete `.github/workflows/context-mode-review.yml` and push. Then revoke the CI key on the console under Profile > Devices, and remove the `CONTEXT_MODE_KEY` secret from the repo. A CI key also ends by itself when it expires (90 days unless you set `--expires`). ## Start now Sign in once, then two commands in your repo. [Open the Console](https://console.contextmode.ai/login) to see your workspace and your CI keys. ``` npx @context-mode/cli login npx @context-mode/cli ci init npx @context-mode/cli ci key create --repo owner/name --gh ``` - Console: [console.contextmode.ai](https://console.contextmode.ai) ([start free](https://console.contextmode.ai/login)) - CLI: `npx @context-mode/cli` (Node 20.12 or later) - Docs: [Quick start](https://contextmode.ai/docs/quick-start) and [the CLI](https://contextmode.ai/docs/cli) On your own machine, each app with its makers' own install: [Claude Desktop](https://contextmode.ai/blog/claude-desktop-context-mode), [the ChatGPT desktop app](https://contextmode.ai/blog/codex-desktop-context-mode), [Pi](https://contextmode.ai/blog/pi-coding-agent-context-mode), [OpenCode](https://contextmode.ai/blog/opencode-context-mode) and [T3 Code](https://contextmode.ai/blog/t3-code-context-mode), or all of them in [one command](https://contextmode.ai/blog/seven-coding-agents-one-gateway). Context Mode is under the Elastic License 2.0 (ELv2). [Get started free](https://console.contextmode.ai/login) [All posts](https://contextmode.ai/blog)