agentmods.dev

apm: Instructions file for GitHub Copilot

.github/instructions/cicd.instructions.md

apm cicd.instructions.md is an instructions file for GitHub Copilot from microsoft/apm. It costs 2,842 tokens per session, scanned A, original, MIT.

Instructions for setting up GitHub CI/CD workflows, meaning automated checks and release steps, for packaging a Python application into a PyInstaller executable. The setup separates quick pull-request checks from heavier merge and integration checks.

In plain words
What is it for?
Configuring pull-request validation, merge-queue testing, Linux binary builds, smoke and integration tests, and release checks for a PyInstaller-based project.
Why use it?
It makes builds, tests, binary packaging, and release validation repeatable. It also defines when each workflow runs and how build artifacts move to later checks.

Instructions file for GitHub Copilot ✓ vendor

Written for GitHub Copilot: a Copilot instructions file. Also seen: mentions Codex.

This is microsoft/apm's own configuration. It tells GitHub Copilot how to work on apm itself, so it is not a mod to install elsewhere. Copy it as a starting point and replace the rules that are about this project. Everything apm configures →

not rated 4.1krepo +38 yesterday A scan 2,842 tokens original MIT
View source ↗ microsoft/apm microsoft.github.io
About the project

APM is a package manager for AI-agent configuration, using a manifest to declare reusable instructions, skills, prompts, agents, hooks, plugins, and MCP components. Development teams use it to reproduce agent setups across projects and control their dependencies through policies and lockfiles, while the catalogue contains many of these agent components.

microsoft/apm · 4,133 stars · on GitHub · microsoft.github.io

Reuse

Borrowing it

Nothing to install: this file belongs to microsoft/apm. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file
curl -O https://raw.githubusercontent.com/microsoft/apm/main/.github/instructions/cicd.instructions.md
Clone the repo
git clone --depth 1 https://github.com/microsoft/apm

Made for: GitHub Copilot.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for apm cicd.instructions.md

README.md
[![agentmods](https://agentmods.dev/badge/instructions/microsoft/apm/cicd/github.svg)](https://agentmods.dev/instructions/microsoft/apm/cicd)
Your own site
<a href="https://agentmods.dev/instructions/microsoft/apm/cicd"><img src="https://agentmods.dev/badge/instructions/microsoft/apm/cicd/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for apm cicd.instructions.md

Your own site · 80×15
<a href="https://agentmods.dev/instructions/microsoft/apm/cicd"><img src="https://agentmods.dev/badge/instructions/microsoft/apm/cicd.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 2,842 This file is loaded in full into every session.
When invoked 2,842 The same file — it is already loaded in full.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.02842 $0.02842
Opus 5.5 $0.01137 $0.01137
Sonnet 5.5 $0.00568 $0.00568
Haiku 4.5 $0.00284 $0.00284

Measured 1mo ago against content hash 33201cb88ea2, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

apm cicd.instructions.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.github/instructions/cicd.instructions.md · 119 lines

How it starts

The opening of the file, as written. The whole thing — 119 lines — stays where its author put it; the contents beside it link to each section on GitHub.

CI/CD Pipeline Instructions

Workflow Architecture (Tiered + Merge Queue)

Five workflows split by trigger and tier. PRs get fast feedback; the heavy integration suite runs only at merge time via GitHub Merge Queue (microsoft/apm#770).

  1. ci.yml - Tier 1, runs on pull_request AND merge_group
    • Linux-only (ubuntu-24.04). Combined build-and-test job: unit tests + binary build in a single runner. No secrets needed.
    • Uploads Linux x86_64 binary artifact for downstream integration testing.
    • Runs in both PR context (fast feedback for contributors) and merge_group context (against the tentative merge commit before queue auto-merges).
  2. ci-integration.yml - Tier 2, merge_group trigger only
    • Linux-only. Builds binary inline, then runs smoke + integration + release-validation against the tentative merge commit.
    • Trust boundary is the write-access grant (only users with write can enqueue a PR). No environment approval gate.
    • Inlines the binary build instead of fetching from ci.yml to avoid cross-workflow artifact plumbing across triggers.
    • Never add a pull_request or pull_request_target trigger here. This file holds production secrets (GH_CLI_PAT, ADO_APM_PAT). Required-check satisfaction at PR time is handled by merge-gate.yml, which aggregates all required signals into a single gate check.
  3. merge-gate.yml - single-authority PR-time aggregator
    • Triggers on pull_request only (single trigger - dual-trigger with pull_request_target produces SUCCESS+CANCELLED check-run twins via cancel-in-progress and poisons branch protection's rollup).
    • One job named gate. Polls the Checks API for all entries in the workflow's EXPECTED_CHECKS env var; aggregates pass/fail into a single check-run.
    • Branch protection requires ONLY this one check (gate). Adding, renaming, or removing an underlying check is a merge-gate.yml edit, never a ruleset edit. Tide / bors single-authority pattern.
    • Recovery if the pull_request webhook is dropped: empty commit, gh workflow run merge-gate.yml -f pr_number=NNN, or close+reopen.
    • .github/CODEOWNERS requires Lead Maintainer review for any change to .github/workflows/**.
  4. build-release.yml - push to main, tags, schedule, workflow_dispatch
    • Linux + Windows run combined build-and-test (unit tests + binary build in one job). Unit tests run on every push for platform-regression signal; smoke tests are gated to tag/schedule/dispatch only (promotion boundaries) to avoid duplicating ci-integration.yml's merge-time smoke and to cut redundant codex-binary downloads.
    • macOS Intel uses build-and-validate-macos-intel (root node, runs own unit tests - no dependency on build-and-test). Builds the binary on every push for early regression feedback; tag/schedule/dispatch promotion runs add marker-bounded lifecycle_smoke and not live integration coverage and isolated release validation.
    • macOS ARM uses build-and-validate-macos-arm (root node, tag/schedule/dispatch only - ARM runners are extremely scarce with 2-4h+ queue waits). Promotion runs retain the full non-live integration corpus and isolated release validation.
    • Publication jobs do not receive ADO_APM_PAT; live ADO PAT acceptance is an explicit ado_pat_e2e mode in auth-acceptance.yml. Full 5-platform binary output (linux x86_64/arm64, darwin x86_64/arm64, windows x86_64).
  5. ci-runtime.yml - nightly schedule, manual dispatch, path-filtered push
    • Linux x86_64 only. Live inference smoke tests (apm run) isolated from release pipeline.
    • Uses GH_MODELS_PAT for GitHub Models API access.
    • Failures do not block releases - annotated as warnings.

Read the full file on GitHub · 119 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 1mo ago First seen · 119 lines · 2,842 tokens per session scan A 33201cb88ea2

Subscribe to this mod's changes

apm cicd.instructions.md is an instructions file published in the GitHub repository microsoft/apm (4,133 stars, last pushed yesterday), licensed MIT. It adds 2,842 tokens to every session, about $0.0114 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

CI and CDClaude CodeDevOps and cloudai-agentscodex-clicontext-engineeringgithub-copilotprompt-engineering
Related

Other instructions, from other repositories

ai-agent-rules-generator ratelimitting.instructions.md

Instructions for savedpixel/ai-agent-rules-generator, covering rate limit prevention (critical), rules, output length limits and visibility.

savedpixel/ai-agent-rules-generator · 522 tokens

vscode buildNext.instructions.md

Working notes and architecture documentation for the new esbuild-based build system in build/next. Use when making changes to the new build pipeline (transpile/bundle commands, NLS plugin, source-map handling, resource copying, or self-hosting watch tasks).

microsoft/vscode · 9,715 tokens

next.js AGENTS.md

AGENTS.md instructions for vercel/next.js, covering next.js development guide, codebase structure, monorepo overview, core package: packages/next and other important packages.

vercel/next.js · 7,786 tokens

vscode oss-third-party-notices.instructions.md

Instructions for microsoft/vscode, covering vs code oss third-party-notices pipeline, architecture, pipeline flow in ci, cache eligibility and rollout and applying the notice (cutover).

microsoft/vscode · 5,262 tokens

langchain AGENTS.md

AGENTS.md instructions for langchain-ai/langchain, covering global development guidelines for the langchain monorepo, corridor security analysis, project architecture and context, monorepo structure and development tools & commands.

langchain-ai/langchain · 4,680 tokens

vscode copilot-instructions.md

Copilot instructions for microsoft/vscode, covering vs code copilot instructions, project overview, root folders, core architecture (src/ folder) and built-in extensions (extensions/ folder).

microsoft/vscode · 2,731 tokens