PRODUCTION SCENARIO
A GitHub Actions job runs Claude Code to review pull request diffs and post comments. Nobody is at a terminal. The reviewer must not modify the branch it is reviewing, anything the allow list does not cover has to be refused rather than approved, the review has to follow the conventions in the repository's committed CLAUDE.md and run its project hooks, and the runner is shared with other jobs rather than a disposable container.
How should the run be configured?
Answering here is anonymous. Nothing is saved unless you sign in.
Show answer and explanation
Answer: --permission-mode dontAsk on a claude -p run with an --allowedTools list
dontAsk denies every call that would otherwise prompt while still permitting what the allow list covers, which is the documented shape for a locked-down CI run and meets the no-prompt and refuse-by-default requirements at once. acceptEdits is right when the job exists to apply fixes and commit them, and this one must leave the branch alone. bypassPermissions is right in a disposable sandbox where nothing outside matters, and this runner is shared. Bare mode is right when a scripted run must behave identically on every machine, which is exactly why it skips the repository's hooks and CLAUDE.md; this review depends on both.
Official Source: https://code.claude.com/docs/en/headless ↗