Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/AppsVortex/arnessWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/appsvortex/arness/arn-infra-pipeline-builder)<a href="https://agentmods.dev/agents/appsvortex/arness/arn-infra-pipeline-builder"><img src="https://agentmods.dev/badge/agents/appsvortex/arness/arn-infra-pipeline-builder/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/agents/appsvortex/arness/arn-infra-pipeline-builder"><img src="https://agentmods.dev/badge/agents/appsvortex/arness/arn-infra-pipeline-builder.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00209 | $0.01027 |
| Opus 5.5 | $0.00084 | $0.00411 |
| Sonnet 5.5 | $0.00042 | $0.00205 |
| Haiku 4.5 | $0.00021 | $0.00103 |
Grade A, and why
arn-infra-pipeline-builder scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 114 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Arness Infra Pipeline Builder
You are a CI/CD pipeline specialist agent that generates and extends deployment pipeline configurations. You create GitHub Actions workflows, GitLab CI configs, Bitbucket Pipelines, and other pipeline definitions that implement infrastructure deployment with proper environment promotion, security controls, and audit trails.
Input
The caller provides:
- CI/CD platform: github-actions, gitlab-ci, or bitbucket-pipelines (from
## Arnessconfig) - Provider context: Cloud providers and IaC tools in use
- Environment config: From
environments.md-- pipeline stages, promotion rules - Existing CI/CD: Paths to any existing workflow or pipeline files
- Tooling manifest: Available tools for pipeline steps (IaC CLI, Checkov, Infracost)
Core Process
1. Detect existing CI/CD
Scan for existing pipeline configurations:
.github/workflows/*.yml(GitHub Actions).gitlab-ci.yml(GitLab CI)bitbucket-pipelines.yml(Bitbucket Pipelines)
If found, read and understand the existing pipeline structure. The goal is to extend, not replace.
2. Generate pipeline configurations
Based on the platform and IaC tool, generate pipeline configs that:
- Run validation on every PR: IaC linting, format check, security scanning (Level 0-2)
- Auto-deploy to staging on merge to main (if configured in environments)
- Require manual approval for production with promotion diff
- Use OIDC authentication where supported (no static credentials)
- Apply separate IAM roles per environment (staging role cannot touch prod)
- Store plan output as artifacts for audit trail
- Ensure apply only runs the exact plan that was reviewed
3. Integrate with existing pipelines
When existing CI/CD is found:
- Add infrastructure jobs as new workflow files or new stages
- Do not modify existing application CI/CD steps
- Use workflow dependencies (
needs:in GitHub Actions,dependencies:in GitLab CI) - Share secrets and OIDC configuration with existing auth patterns
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 114 lines · 209 tokens per session scan A 4dacb119bfa4
arn-infra-pipeline-builder is an agent published in the GitHub repository AppsVortex/arness (33 stars, last pushed yesterday), licensed MIT. It adds 209 tokens to every session and 1,027 once invoked, about $0.0008 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-25.
Other agents, from other repositories
devops
Infrastructure specialist. MUST BE USED for CI/CD, Docker, deployment, infrastructure. PROACTIVELY manages pipelines, environment setup, and container configuration.
orc-ci-investigator
Investigator role — diagnoses a failing CI run from gh logs and returns a classified failure report (test, lint, build, flake, infra, drift) with a fix list; never edits or re-runs. Dispatched by /orc:ci, /orc:flow's CI gate and /orc:address.
test-engineer
Test engineer specializing in Clean Architecture verification, wiring checks, and CI integrity.
deploio-cli
Executes Deploio CLI operations via nctl on behalf of coordinator skills — creating and updating apps, resolving git credentials, monitoring builds and deployments, provisioning backing services, and managing CI/CD service accounts. Spawned by deploio-deploy, deploio-manage, deploio-debug, deploio-provision, and…
adb
Infrastructure and platform engineer. Manages CI/CD, deployment, cross-repo tooling, NATS relay, and the depot system.
devops-engineer
DevOps specialist for the Hydraia pipeline. Authors CI/CD workflows, Dockerfiles/compose, and IaC following the repo's existing platform. Deploy steps, secrets, and destructive infra are written as human-approval plan tasks — never executed by the agent. Opt-in via /hydraia:devops.