What is apm cicd.instructions.md?

Instructions for setting up GitHub CI/CD workflows, meaning automated checks and release steps, for packaging a Python application into a PyInstaller executable. The setup separates quick pull-request checks from heavier merge and integration checks.

Configuring pull-request validation, merge-queue testing, Linux binary builds, smoke and integration tests, and release checks for a PyInstaller-based project.

It makes builds, tests, binary packaging, and release validation repeatable. It also defines when each workflow runs and how build artifacts move to later checks.

apm cicd.instructions.md — Instructions file by microsoft

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods

npx agentmods add instructions/microsoft/apm/cicd

Clone the repo

git clone --depth 1 https://github.com/microsoft/apm

Made for: GitHub Copilot.

Per session 2,842 This file is loaded in full into every session.

When invoked 2,842 The same file — it is already loaded in full.

Security scan A 0 findings. Scan, not verified.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5	$0.02842	$0.02842
Opus 5	$0.01421	$0.01421
Sonnet 5	$0.00568	$0.00568
Haiku 4.5	$0.00284	$0.00284

Measured yesterday against content hash 33201cb88ea2, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

apm cicd.instructions.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.github/instructions/cicd.instructions.md · 119 lines

How it starts

The opening of the file, as written. The whole thing — 119 lines — stays where its author put it; the contents beside it link to each section on GitHub.

CI/CD Pipeline Instructions

Workflow Architecture (Tiered + Merge Queue)

Five workflows split by trigger and tier. PRs get fast feedback; the heavy integration suite runs only at merge time via GitHub Merge Queue (microsoft/apm#770).

ci.yml - Tier 1, runs on pull_request AND merge_group
- Linux-only (ubuntu-24.04). Combined build-and-test job: unit tests + binary build in a single runner. No secrets needed.
- Uploads Linux x86_64 binary artifact for downstream integration testing.
- Runs in both PR context (fast feedback for contributors) and merge_group context (against the tentative merge commit before queue auto-merges).
ci-integration.yml - Tier 2, merge_group trigger only
- Linux-only. Builds binary inline, then runs smoke + integration + release-validation against the tentative merge commit.
- Trust boundary is the write-access grant (only users with write can enqueue a PR). No environment approval gate.
- Inlines the binary build instead of fetching from ci.yml to avoid cross-workflow artifact plumbing across triggers.
- Never add a pull_request or pull_request_target trigger here. This file holds production secrets (GH_CLI_PAT, ADO_APM_PAT). Required-check satisfaction at PR time is handled by merge-gate.yml, which aggregates all required signals into a single gate check.
merge-gate.yml - single-authority PR-time aggregator
- Triggers on pull_request only (single trigger - dual-trigger with pull_request_target produces SUCCESS+CANCELLED check-run twins via cancel-in-progress and poisons branch protection's rollup).
- One job named gate. Polls the Checks API for all entries in the workflow's EXPECTED_CHECKS env var; aggregates pass/fail into a single check-run.
- Branch protection requires ONLY this one check (gate). Adding, renaming, or removing an underlying check is a merge-gate.yml edit, never a ruleset edit. Tide / bors single-authority pattern.
- Recovery if the pull_request webhook is dropped: empty commit, gh workflow run merge-gate.yml -f pr_number=NNN, or close+reopen.
- .github/CODEOWNERS requires Lead Maintainer review for any change to .github/workflows/**.
build-release.yml - push to main, tags, schedule, workflow_dispatch
- Linux + Windows run combined build-and-test (unit tests + binary build in one job). Unit tests run on every push for platform-regression signal; smoke tests are gated to tag/schedule/dispatch only (promotion boundaries) to avoid duplicating ci-integration.yml's merge-time smoke and to cut redundant codex-binary downloads.
- macOS Intel uses build-and-validate-macos-intel (root node, runs own unit tests - no dependency on build-and-test). Builds the binary on every push for early regression feedback; tag/schedule/dispatch promotion runs add marker-bounded lifecycle_smoke and not live integration coverage and isolated release validation.
- macOS ARM uses build-and-validate-macos-arm (root node, tag/schedule/dispatch only - ARM runners are extremely scarce with 2-4h+ queue waits). Promotion runs retain the full non-live integration corpus and isolated release validation.
- Publication jobs do not receive ADO_APM_PAT; live ADO PAT acceptance is an explicit ado_pat_e2e mode in auth-acceptance.yml. Full 5-platform binary output (linux x86_64/arm64, darwin x86_64/arm64, windows x86_64).
ci-runtime.yml - nightly schedule, manual dispatch, path-filtered push
- Linux x86_64 only. Live inference smoke tests (apm run) isolated from release pipeline.
- Uses GH_MODELS_PAT for GitHub Models API access.
- Failures do not block releases - annotated as warnings.

Read the full file on GitHub · 119 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

yesterday First seen · 119 lines · 2,842 tokens per session scan A 33201cb88ea2

Subscribe to this mod's changes

apm cicd.instructions.md is an instructions file published in the GitHub repository microsoft/apm (3,668 stars, last pushed yesterday), licensed MIT. It adds 2,842 tokens to every session, about $0.0142 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

DevOps and cloud Git and workflow Testing ai-agents claude-code codex-cli context-engineering github-copilot prompt-engineering

apm cicd.instructions.md

Getting it into your agent

What it costs to keep this loaded

Grade A, and why

Nothing flagged

How it starts

CI/CD Pipeline Instructions

Workflow Architecture (Tiered + Merge Queue)

What this file has done since we first saw it

Other instructions, from other repositories

aru AGENTS.md

skillport AGENTS.md

odin-codex-plugin AGENTS.md

copilot-setting AGENTS.md

loadout reactjs.instructions.md

loadout tauri.instructions.md