Auto-PR Workflows: Turning a Green Headless Run Into an Open Pull Request

Act II continues. We turn a passing headless Claude Code run into an open pull request with no human at the keyboard, and we walk straight into the pitfall that breaks most first attempts.

News (June 17–21, 2026):

• v2.1.183 — Auto mode now blocks destructive git commands you didn't ask for (git reset --hard, git checkout -- ., git clean -fd, git stash drop), blocks git commit --amend on commits it didn't make this session, and guards terraform destroy / pulumi destroy / cdk destroy. New attribution.sessionUrl setting omits the claude.ai link from commits and PRs. New /config --help; in the toggle, Esc now SAVES.
• v2.1.181 — /config key=value inline from the prompt (works in -p and Remote Control), sandbox.allowAppleEvents, CLAUDE_CLIENT_PRESENCE_FILE to mute mobile pings, bundled Bun 1.4, line-by-line streaming, auto-retry on dropped connections.
• v2.1.185 — Stream-stall hint reworded and now fires after 20s instead of 10s.

Tutorial — Auto-PR:

• Two homes for the logic: a local/cron bash script wrapping claude -p then git + gh, or a GitHub Actions workflow governed by permissions:.
• Prefer a deterministic shell GATE (tests green? non-empty diff? existing PR?) and scope Claude to the edit. Headless docs, CLI reference.
• Always git push -u origin <branch> before gh pr create — the push prompt is fatal with no TTY.
• Actions needs contents: write AND pull-requests: write; missing the second is a silent 403.
• The big one: PRs opened with the default GITHUB_TOKEN do not trigger downstream workflows. Use a GitHub App token so the PR's own CI actually runs.
• Idempotency: deterministic branch names + gh pr list --head guard. Empty-diff guard with git diff --quiet.
• --allowedTools prefix footgun: Bash(git push *) with the trailing space, not Bash(git push*).
• The pull_request_target footgun only bites on untrusted fork code; internal nightly auto-PR is on the safe side.