bitrise-workflow-editor: Instructions file for Claude Code

CLAUDE.md

bitrise-workflow-editor CLAUDE.md is an instructions file for Claude Code from bitrise-io/bitrise-workflow-editor. It costs 816 tokens per session, scanned A, original, MIT.

Repository guidance for the Bitrise Workflow Editor, which lets users edit a YAML configuration document through typed screens and saves it through a Go server. YAML is a text format commonly used for configuration.

In plain words
What is it for?
Use it when changing the YAML editor, its Zustand state store, Go services, linked include files, or Bitrise CLI and website builds.
Why use it?
It explains the editor’s architecture, its CLI and website modes, and where to find answers about its data and flows.

Instructions file for Claude Code

Written for Claude Code: the file is CLAUDE.md. Also seen: mentions CLAUDE.md; mentions AGENTS.md.

This is bitrise-io/bitrise-workflow-editor's own configuration. It tells Claude Code how to work on bitrise-workflow-editor itself, so it is not a mod to install elsewhere. Copy it as a starting point and replace the rules that are about this project. Everything bitrise-workflow-editor configures →

Reuse

Borrowing it

Nothing to install: this file belongs to bitrise-io/bitrise-workflow-editor. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file
curl -O https://raw.githubusercontent.com/bitrise-io/bitrise-workflow-editor/master/CLAUDE.md
Clone the repo
git clone --depth 1 https://github.com/bitrise-io/bitrise-workflow-editor

Made for: Claude Code.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for bitrise-workflow-editor CLAUDE.md

README.md
[![agentmods](https://agentmods.dev/badge/instructions/bitrise-io/bitrise-workflow-editor/claude-md/github.svg)](https://agentmods.dev/instructions/bitrise-io/bitrise-workflow-editor/claude-md)
Your own site
<a href="https://agentmods.dev/instructions/bitrise-io/bitrise-workflow-editor/claude-md"><img src="https://agentmods.dev/badge/instructions/bitrise-io/bitrise-workflow-editor/claude-md/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for bitrise-workflow-editor CLAUDE.md

Your own site · 80×15
<a href="https://agentmods.dev/instructions/bitrise-io/bitrise-workflow-editor/claude-md"><img src="https://agentmods.dev/badge/instructions/bitrise-io/bitrise-workflow-editor/claude-md.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 816 This file is loaded in full into every session.
When invoked 816 The same file — it is already loaded in full.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00816 $0.00816
Opus 5.5 $0.00326 $0.00326
Sonnet 5.5 $0.00163 $0.00163
Haiku 4.5 $0.00082 $0.00082

Measured 14d ago against content hash d46aa2a21978, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

bitrise-workflow-editor CLAUDE.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 14d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

CLAUDE.md · 60 lines

How it starts

The opening of the file, as written. The whole thing — 60 lines — stays where its author put it; the contents beside it link to each section on GitHub.

CLAUDE.md

@./node_modules/@bitrise/bitkit-v2/AGENTS.md

The editor holds one YAML document as an AST in a Zustand store (BitriseYmlStore) and edits it through typed UIs. Pages read the document, services in core/services mutate it, and the Go server validates and saves it. Secrets, stacks, license pools and the step catalog live outside the document and have their own endpoints.

With include: the config is a tree of files, and the document is only the active file. Every service reaches only that far (why).

It ships as a Bitrise CLI plugin (MODE=CLI, the default) and inside the Bitrise website (MODE=WEBSITE, an iframe). Branch on mode in core/api and components, never in a service.

docs/decisions.md explains the parts that look odd on purpose. Read it before "fixing" one.

Commands

npm start                # Dev server + local Go API on port 4000
npm run start:website    # Website mode (needs the monolith on :3000)
npm run build            # Vite production build
npm run lint             # ESLint (cached)
npx tsc --noEmit         # The only type check. Not a script, not in CI
npm test                 # Jest
npm test -- --testPathPatterns="path/to/file"
npm run test:smoke       # Playwright, post-deploy only (needs SMOKE_TEST_* env vars)
npm run storybook        # Storybook on 6006
go vet ./... && go test ./...

The dev server is at localhost:4000/{version}, with the version from package.json.

The rule nothing enforces

Never read yml, edit the plain object, and write it back. toJSON is for reading. Structured edits go through a service calling updateBitriseYmlDocument, and inside the mutator you touch nodes only through YmlUtils. Round-tripping through JSON destroys every comment and anchor and rewrites the formatting, in a file the user reviews in a diff.

Traps

  • Nothing type-checks unless you do it. CI runs build, lint and tests, and vite build strips types without checking them. Run npx tsc --noEmit before calling a typed change done.
  • window.env does not exist under Jest, so RuntimeUtils.isProduction() throws in unit tests. Wrap it the way BitriseYmlStore.warnInDev does.
  • A store setter called outside act() does not flush, so the test passes falsely. Watch a repro fail before you trust it passing.
  • Jest's environment is node. A test that renders needs an @jest-environment jsdom docblock.
  • After pulling across a version bump, restart the Go process (it keeps the old version path, so every request 404s) and run npm install.
  • Four boundaries are linted: core/ may not import React, .tsx may not call updateBitriseYmlDocument, useShallow comes from @/hooks/useShallow, and raw useStore may not build a fresh value. A no-restricted-* failure means you crossed one.
  • Pathless <DiffEditor>s leak their Monaco models on purpose. Disposing them makes Monaco throw on every unmount; that was #1898, reverted after it reached production.

Read the full file on GitHub · 60 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 14d ago Changed d46aa2a21978
  2. 1mo ago Changed · -59 lines · -830 tokens per session e0308f148b93
  3. 1mo ago Changed · +8 lines · +181 tokens per session e0084ce8563a
  4. 2mo ago Changed · -33 lines · -660 tokens per session 5b39a57c2beb
  5. 2mo ago First seen · 144 lines · 2,125 tokens per session scan A 177847969178

Subscribe to this mod's changes

bitrise-workflow-editor CLAUDE.md is an instructions file published in the GitHub repository bitrise-io/bitrise-workflow-editor (115 stars, last pushed yesterday), licensed MIT. It adds 816 tokens to every session, about $0.0033 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-01.

Related

bitrise-workflow-editor CLAUDE.md compared with instructions from other repositories

bitrise-workflow-editor CLAUDE.md next to 6 instructions from other repositories
ModTypeStarsLast pushLicenceScanTokensWorks with
bitrise-workflow-editor CLAUDE.mdbitrise-io/bitrise-workflow-editorInstructions file115yesterdayMITA816Claude Code
vscode buildNext.instructions.mdmicrosoft/vscodeInstructions file195kyesterdayMITA9,719GitHub Copilot
next.js AGENTS.mdvercel/next.jsInstructions file143ktodayMITA7,461Codex, OpenCode
langchain AGENTS.mdlangchain-ai/langchainInstructions file149kyesterdayMITA4,680Codex, OpenCode
vscode oss-third-party-notices.instructions.mdmicrosoft/vscodeInstructions file195kyesterdayMITA5,516GitHub Copilot
vscode copilot-instructions.mdmicrosoft/vscodeInstructions file195kyesterdayMITA3,093GitHub Copilot
deepseek-harness AGENTS.mddeepseek-ai/deepseek-harnessInstructions file274k2d agoMITA4,313Codex, OpenCode