ci

2 questions

AI

How do I wire Claude Code into my GitHub PRs without giving it my production secrets?

Install the Claude Code GitHub Action via /install-github-app, scope ANTHROPIC_API_KEY as a repo or environment secret, and pass only the secrets a PR job actually needs. The webhook is GitHub's; the work runs on GitHub's runners; the failure mode is mis-scoped secrets, not the action itself.
AI

Setup or SessionStart hook for my install script?

SessionStart fires on every session start, resume, `/clear`, and post-compaction, so it has to be fast. Setup fires only on explicit `claude --init-only`, `claude -p --init`, or `claude -p --maintenance`, which makes it the right home for slow one-time work like dependency installs or scheduled cleanup. Neither hook can block Claude from starting; for hard preconditions, gate the `claude` binary, not the hook.