What is harbor-next AGENTS.md?

Repository instructions for Harbor Next, a Go and Angular project that manages container images. They define coding, pull-request, GitHub Actions, and release-automation rules.

Use them when changing Harbor Next, running its builds and tests, writing workflows, preparing pull requests, or handling releases.

They give a coding agent the project context and contribution rules needed to make changes safely and consistently.

How container-registry/harbor-next configures Codex and OpenCode

Reuse

Borrowing it

Nothing to install: this file belongs to container-registry/harbor-next. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file

curl -O https://raw.githubusercontent.com/container-registry/harbor-next/main/AGENTS.md

Clone the repo

git clone --depth 1 https://github.com/container-registry/harbor-next

Made for: Codex, OpenCode.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/instructions/container-registry/harbor-next/agents-md/github.svg)](https://agentmods.dev/instructions/container-registry/harbor-next/agents-md)

Your own site

<a href="https://agentmods.dev/instructions/container-registry/harbor-next/agents-md"><img src="https://agentmods.dev/badge/instructions/container-registry/harbor-next/agents-md/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/instructions/container-registry/harbor-next/agents-md"><img src="https://agentmods.dev/badge/instructions/container-registry/harbor-next/agents-md.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 543 This file is loaded in full into every session.

When invoked 543 The same file — it is already loaded in full.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00543	$0.00543
Opus 5.5	$0.00217	$0.00217
Sonnet 5.5	$0.00109	$0.00109
Haiku 4.5	$0.00054	$0.00054

Measured 1mo ago against content hash 3970ca2db39e, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

harbor-next AGENTS.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

AGENTS.md · 43 lines

How it starts

The opening of the file, as written. The whole thing — 43 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Harbor Next Agent Notes

Enhanced fork of goharbor/harbor. Go backend in src/, Angular frontend in src/portal/, build automation via Taskfile.

Commands

task build        # Build Go binaries
task test:quick   # API lint + unit tests
task test:ci      # Full CI pipeline
task images       # Build/push Docker images
task dev:up       # Local dev with hot reload
task apply-patches # Apply branches listed in taskfile/commercial-patches with jj
task release-ready # Verify those patches against a clean clone

Go test/build need generated API first: task build:gen-apis.

PRs

Branch off main, never push direct.
Conventional Commits, capitalized subject: feat: Add Foo, fix: Resolve Bar, upstream: Cherry-Pick Harbor Fix.
DCO sign-off required: git commit -s.
Squash and merge only; other merge types break release-please.
No Co-Authored-By or AI attribution trailers.
New features (feat:) must add a ## Release Notes section to the PR description. Its content is extracted and rendered under ## Summary on the GitHub Release.

GitHub Actions

Self-hosted runners are intentionally minimal. When adding a workflow shell command that calls a CLI or interpreter, explicitly install or set up that tool in the same job before using it. Do not assume runner images or JavaScript action runtimes expose tools on PATH.
Pin actions by full commit SHA and keep a version comment, matching the existing workflow style.
If a workflow calls node, add an explicit actions/setup-node step first.

Release-Please

main uses always-bump-minor; VERSION on main tracks the next development release while .release-please-manifest.json tracks the published release. release-X.Y branches use patch-only versioning. ci:, build:, chore:, test: are hidden from release notes.

exclude-paths: changes touching only .github/, docs/, tests/, or taskfile/ don't bump version. Use ci: for CI-only changes.

Read the full file on GitHub · 43 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

1mo ago Changed 3970ca2db39e
2mo ago First seen · 43 lines · 543 tokens per session scan A decc80c1941f

Subscribe to this mod's changes

harbor-next AGENTS.md is an instructions file published in the GitHub repository container-registry/harbor-next (33 stars, last pushed today), licensed Apache-2.0. It adds 543 tokens to every session, about $0.0022 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.

CI and CD DevOps and cloud Git and workflow Releases artifact-management artifact-registry cncf-project container-registry harbor harbor-registry

harbor-next AGENTS.md next to 6 instructions from other repositories
Mod	Type	Stars	Last push	Licence	Scan	Tokens	Works with
harbor-next AGENTS.mdcontainer-registry/harbor-next	Instructions file	33	today	Apache-2.0	A	543	Codex, OpenCode
vscode buildNext.instructions.mdmicrosoft/vscode	Instructions file	195k	yesterday	MIT	A	9,719	GitHub Copilot
next.js AGENTS.mdvercel/next.js	Instructions file	143k	yesterday	MIT	A	7,461	Codex, OpenCode
langchain AGENTS.mdlangchain-ai/langchain	Instructions file	149k	yesterday	MIT	A	4,680	Codex, OpenCode
vscode oss-third-party-notices.instructions.mdmicrosoft/vscode	Instructions file	195k	yesterday	MIT	A	5,516	GitHub Copilot
vscode copilot-instructions.mdmicrosoft/vscode	Instructions file	195k	yesterday	MIT	A	3,093	GitHub Copilot
deepseek-harness AGENTS.mddeepseek-ai/deepseek-harness	Instructions file	274k	2d ago	MIT	A	4,313	Codex, OpenCode

harbor-next: Instructions file for Codex