A hands-on tutorial on wiring [`anthropics/claude-code-action`](https://github.com/anthropics/claude-code-action) so that applying a GitHub label kicks off an implement pass with no `@claude` mention. Plus the week's Claude Code news. ## News (June 21-25, 2026) - **claude-code-action**: v1.0.157, v1.0.156 (June 24), v1.0.155 (June 23). Merged fixes per the [releases page](https://github.com/anthropics/claude-code-action/releases): filter PR reviews/inline comments to trigger time ([#1385](https://github.com/anthropics/claude-code-action/issues/1385)), allow `@` in branch names (#1411), format-turns content-type fallback tests (#1421). Bump to v1.0.157. - **CLI v2.1.191** (June 24): new `/rewind` to recover a session cleared with `/clear`; stopped background agents stay stopped; comma-separated hook matchers fixed; MCP retry logic; ~37% lower streaming CPU. - **CLI v2.1.187** (June 23): new `sandbox.credentials` setting blocks sandboxed commands from reading secrets, org model restrictions, remote MCP 5-min idle timeout (`CLAUDE_CODE_MCP_TOOL_IDLE_TIMEOUT`), `/install-github-app` workflow setup now optional. - **Billing**: the planned move of Agent SDK / Claude Code usage onto a separate credit is [NOT taking effect](https://codersera.com/blog/anthropic-june-2026-billing-change-claude-code/); being reworked with advance notice. ## Tutorial: label as the trigger - GitHub fires a `labeled` activity on the `issues` event. Use `on: issues: types: [labeled]` and gate with `if: github.event.label.name == 'claude-implement'` — without the `if`, every label burns a run. See [Events that trigger workflows](https://docs.github.com/en/actions/reference/workflows-and-actions/events-that-trigger-workflows). - Two gates: the action's `label_trigger: "claude"` input, or workflow-level `types: [labeled]` + an `if`. v1 auto-detects automation mode when you set an explicit `prompt`. - v1 consolidated inputs: `direct_prompt`/`override_prompt`/`mode` → `prompt`; `model`/`max_turns`/`allowed_tools`/`custom_instructions` → `claude_args`. Pin [`@v1`](https://github.com/anthropics/claude-code-action), not `@beta`. Known bug [#210](https://github.com/anthropics/claude-code-action/issues/210): early `label_trigger` failed on a missing `LABEL_TRIGGER` env mapping. - **PRs aren't auto-created** (per the action's [security docs](https://github.com/anthropics/claude-code-action)): Claude pushes a branch and links the PR page. Wire `gh pr create` yourself. - **GITHUB_TOKEN can't fire downstream workflows** ([docs](https://docs.github.com/en/actions/concepts/security/github_token), [#25565](https://github.com/orgs/community/discussions/25565)): a default-token PR won't start CI, and a bot-applied label won't fire the labeled workflow. Use [`actions/create-github-app-token@v2`](https://github.com/actions/create-github-app-token). - **Label as a state machine**: `claude-implement` → remove first, add `claude-working` → `claude-done`/`needs-human`. Idempotent + a concurrency group keyed on `issue.number`. See [`gh issue edit`](https://cli.github.com/manual/gh_issue_edit). - **The pitfall**: splicing `issue.body` into the prompt is the [lethal-trifecta](https://www.microsoft.com/en-us/security/blog/2026/06/05/securing-ci-cd-in-agentic-world-claude-code-github-action-case/) injection surface. The label gates who labels, not who wrote the body. Gate authors, treat body as data, shrink blast radius. - **Cron alternative**: poll with `gh issue list --label`, run headless `claude -p`. See the [GitHub Actions docs](https://code.claude.com/docs/en/github-actions).