Label-Driven Runs: Trigger a Claude Code Implement Pass From a GitHub Label

Apply one named label to an issue and Claude Code runs an unattended implement pass that pushes a branch and opens a PR. The label gates who can fire it, not who wrote the issue body, so the spec you splice into the prompt is still attacker-controllable and you must treat it as data.

Episode page & show notes

Try a walking desk - stay healthy & sharp while you learn & code

A hands-on tutorial on wiring anthropics/claude-code-action so that applying a GitHub label kicks off an implement pass with no @claude mention. Plus the week's Claude Code news.

News (June 21-25, 2026)

• claude-code-action: v1.0.157, v1.0.156 (June 24), v1.0.155 (June 23). Merged fixes per the releases page: filter PR reviews/inline comments to trigger time (#1385), allow @ in branch names (#1411), format-turns content-type fallback tests (#1421). Bump to v1.0.157.
• CLI v2.1.191 (June 24): new /rewind to recover a session cleared with /clear; stopped background agents stay stopped; comma-separated hook matchers fixed; MCP retry logic; ~37% lower streaming CPU.
• CLI v2.1.187 (June 23): new sandbox.credentials setting blocks sandboxed commands from reading secrets, org model restrictions, remote MCP 5-min idle timeout (CLAUDE_CODE_MCP_TOOL_IDLE_TIMEOUT), /install-github-app workflow setup now optional.
• Billing: the planned move of Agent SDK / Claude Code usage onto a separate credit is NOT taking effect; being reworked with advance notice.

Tutorial: label as the trigger

• GitHub fires a labeled activity on the issues event. Use on: issues: types: [labeled] and gate with if: github.event.label.name == 'claude-implement' — without the if, every label burns a run. See Events that trigger workflows.
• Two gates: the action's label_trigger: "claude" input, or workflow-level types: [labeled] + an if. v1 auto-detects automation mode when you set an explicit prompt.
• v1 consolidated inputs: direct_prompt/override_prompt/mode → prompt; model/max_turns/allowed_tools/custom_instructions → claude_args. Pin @v1, not @beta. Known bug #210: early label_trigger failed on a missing LABEL_TRIGGER env mapping.
• PRs aren't auto-created (per the action's security docs): Claude pushes a branch and links the PR page. Wire gh pr create yourself.
• GITHUB_TOKEN can't fire downstream workflows (docs, #25565): a default-token PR won't start CI, and a bot-applied label won't fire the labeled workflow. Use actions/create-github-app-token@v2.
• Label as a state machine: claude-implement → remove first, add claude-working → claude-done/needs-human. Idempotent + a concurrency group keyed on issue.number. See gh issue edit.
• The pitfall: splicing issue.body into the prompt is the lethal-trifecta injection surface. The label gates who labels, not who wrote the body. Gate authors, treat body as data, shrink blast radius.
• Cron alternative: poll with gh issue list --label, run headless claude -p. See the GitHub Actions docs.