Capstone: CI Pipeline Guardian

The CI Pipeline Guardian is a Claude Code setup that automatically reviews every PR, runs tests, catches security issues, and posts a structured review, all triggered by GitHub events, running on a schedule, and reporting to Slack. Every piece draws from the five days of the course.

What you'll learn

• A GitHub Actions workflow triggers Claude Code on every PR, review, test, security scan
• A routine runs every morning to summarize overnight PR activity and post to Slack
• A custom skill defines the review checklist the team agreed on
• A custom subagent handles security-specific review with restricted tools

Architecture

The system coordinates several moving parts using webhooks, actions, and custom hooks. The diagram below illustrates how a pull request event flows through the pipeline to produce a final review.

Prerequisites

Complete before starting:

• Installation & Auth: Claude Code installed and authenticated
• Custom Subagents: comfortable creating subagents
• Hooks: understand PreToolUse hooks
• GitHub Integration: GitHub Actions and PR review
• Routines: scheduled automation

Build it

Phase 1: Create the review skill

First, scaffold the directory structure for your custom skills. This ensures the environment is ready for the PR review definitions.

mkdir -p .claude/skills/pr-review

.claude/skills/pr-review/SKILL.md:

---
description: Reviews pull requests for bugs, security issues, missing tests, and style problems. Use when asked to review a PR or code changes.
---

## Review Checklist
1. **Security**: Check for injection vulnerabilities, hardcoded secrets, unsafe deserialization
2. **Correctness**: Verify logic, edge cases, error handling
3. **Tests**: Confirm new code has tests, existing tests still pass
4. **Style**: Check against project conventions in CLAUDE.md
5. **Performance**: Flag N+1 queries, unnecessary allocations, blocking operations

## Instructions
Run `!`git diff origin/main...HEAD`` to get the current diff.
For each issue found, link to the specific line and suggest a fix.
If no issues, say "LGTM" with a brief summary.

Phase 2: Create the security reviewer subagent

.claude/agents/security-reviewer.md:

---
name: security-reviewer
description: Security-focused code review. Use for PRs that touch auth, data handling, or API endpoints.
tools: Read, Grep, Glob
model: sonnet
---

You are a senior security engineer. Review code for:
1. Injection vulnerabilities (SQL, XSS, command injection)
2. Authentication and authorization flaws
3. Hardcoded secrets or API keys
4. Unsafe deserialization
5. Missing input validation
Report each finding with the file, line, severity, and suggested fix.

Phase 3: Add a PreToolUse hook to block destructive commands

Configure the global settings in .claude/settings.json to intercept specific tool usage. The following configuration binds a PreToolUse hook to the Bash tool to prevent destructive operations.

{
  "hooks": {
    "PreToolUse": [{
      "matcher": "Bash",
      "hooks": [{
        "type": "command",
        "if": "Bash(rm *)",
        "command": "./.claude/hooks/block-rm.sh"
      }]
    }]
  }
}

.claude/hooks/block-rm.sh:

#!/bin/bash
COMMAND=$(jq -r '.tool_input.command')
if echo "$COMMAND" | grep -q 'rm -rf'; then
  jq -n '{
    hookSpecificOutput: {
      hookEventName: "PreToolUse",
      permissionDecision: "deny",
      permissionDecisionReason: "Destructive command blocked"
    }
  }'
fi

Phase 4: GitHub Actions workflow

.github/workflows/claude-guardian.yml:

name: Claude Pipeline Guardian
on:
  pull_request:
    types: [opened, synchronize]
jobs:
  review:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Install Claude Code
        run: curl -fsSL https://claude.ai/install.sh | bash
      - name: Run PR Review
        env:
          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
        run: |
          claude --bare -p "Review this PR using the pr-review skill. Use @security-reviewer for auth and data handling code. Run tests if they exist. Post findings as a PR review." \
            --max-turns 15 --output-format json

Phase 5: Daily Slack summary routine

Create a routine (from the web dashboard or /schedule):

Every weekday at 9 AM: Check all PRs opened in the last 24 hours. Summarize: what was merged, what's still open, what needs review. Post the summary to Slack #engineering.

Confirm it worked

1. PR review: Open a PR on the repo. The GitHub Action should run Claude Code and post a review comment
2. Security subagent: Include auth-related code in a PR. The review should mention security findings from the security-reviewer subagent
3. Hook: Try to make Claude run rm -rf in a session. The hook should block it
4. Routine: Check Slack at 9 AM on a weekday. The summary should appear

Module map

Capstone component	Course lesson
Review skill	Custom Commands & Skills
Security subagent	Custom Subagents
PreToolUse hook	Hooks
GitHub Actions workflow	CI/CD Pipelines
Daily Slack routine	Routines & Scheduled Tasks