Borrowing it
Nothing to install: this file belongs to rios0rios0/pipelines. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/rios0rios0/pipelines/main/CLAUDE.mdgit clone --depth 1 https://github.com/rios0rios0/pipelinesWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/instructions/rios0rios0/pipelines/claude-md)<a href="https://agentmods.dev/instructions/rios0rios0/pipelines/claude-md"><img src="https://agentmods.dev/badge/instructions/rios0rios0/pipelines/claude-md/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/instructions/rios0rios0/pipelines/claude-md"><img src="https://agentmods.dev/badge/instructions/rios0rios0/pipelines/claude-md.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.32362 | $0.32362 |
| Opus 5.5 | $0.12945 | $0.12945 |
| Sonnet 5.5 | $0.06472 | $0.06472 |
| Haiku 4.5 | $0.03236 | $0.03236 |
Grade C, and why
pipelines CLAUDE.md scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Downloads and executes remote codehighSupply chain
curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.
- `terraform/tflint/install.sh` and `terraform/terra/install.sh` — pinned, checksum-verified installers that replaced the vendors' `curl … | sh` one-liners on all three platforms Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
- `terraform/tflint/install.sh` and `terraform/terra/install.sh` — pinned, checksum-verified installers that replaced the vendors' `curl … | sh` one-liners on all three platforms How it starts
The opening of the file, as written. The whole thing — 1,159 lines — stays where its author put it; the contents beside it link to each section on GitHub.
CLAUDE.md
This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
What This Is
A CI/CD pipeline templates library providing reusable workflows for GitHub Actions, GitLab CI, and Azure DevOps across Go, Python, Java, JavaScript, PHP, Ruby, .NET, Dart/Flutter, Terraform, and Terra CLI. This is not a runnable application — it provides templates and scripts consumed by other projects.
Commands
make test # Run all validation tests (Go helpers, Go, go-module-toolchain, CycloneDX main detection, Go cache trim, Lambda, YAML merge, SonarQube, release tag, tftest-gen, terra-coverage, order-check, var-catalog, terraform-validate, terraform-provider-mirror, terra-test-roots, terra-install, docker-multi-arch, basic-checks, fixture-isolation, gitignore, sast-gate, hadolint-discovery, checkov, codeql-scope, codeql-gate, dependency-check, dependency-track, goreleaser-prepare, release-version-extraction, release-reconcile, release-promotion, deploy-providers, memory-detection, dart-pipeline, javascript-pipeline, phpmd, terra-pipeline, workflow-composition, working-directory, supply-chain, runner-cache-gating, azure-step-names, azure-secret-env, dependency-updates, containers-detect, report-uploads)
make test-go-script # Test Go validation script only
make test-go-module-toolchain # Test that every go.mod toolchain directive is readable by the images/analysers/workflows that consume it only
make test-go-tool-staleness # Test that a source-built Go tool (govulncheck) is rebuilt when its toolchain/pin moves only
make test-govulncheck-verdict # Test that govulncheck fails on a vulnerability the code calls, read from its report rather than the `-json` exit code only
make test-go-tmpdir-modcache # Test that the Go module cache stays out of $TMPDIR only
make test-go-integration-scope # Test which packages the Go runner's integration phase selects only
make test-lambda # Test Lambda template validation only
make test-yaml-merge # Test golangci-lint/run.sh (config merge, binary reuse and install, toolchain guard) only
make test-sonarqube # Test SonarQube auto-derivation and the retry of a scanner run the server broke only
make test-release-tag-idempotency # Test release tag idempotency only
make test-tftest-gen # Test tftest-gen generator only
make test-terra-coverage # Test the Terraform generic coverage report generator only
make test-order-check # Test the Terragrunt file-ordering checker/fixer only
make test-var-catalog # Test the shared variable-declaration generator only
make test-terraform-validate # Test the root-module `terraform validate` tier only
make test-terraform-provider-mirror # Test the local Terraform provider mirror only
make test-terra-test-roots # Test the terra-test tier's opt-in root-module run (`TERRA_TEST_ROOTS`) only
make test-terra-install # Test the terra CLI installer (pin check, installs that run together on one HOME, Azure DevOps step stops at a failed install) only
make test-docker-multi-arch # Test 40-delivery/docker multi-arch contract only
make test-build-version # Test the version build argument (shared helper, GitHub image delivery, Fly.io deploy, Go workflow wiring) and the delivered image's way to the Fly.io deploy only
make test-containers-detect # Test the Container Images change detection (deleted/renamed folders, dispatch inputs) only
make test-basic-checks # Test basic-checks changelog validation (chlog fragments + legacy CHANGELOG.md) only
make test-fixture-isolation # Test that every suite builds its fixtures in mktemp space and guards every cd only
make test-gitignore # Test the shared .gitignore block generator only
make test-sast-gate # Test that the SAST targets propagate tool failures only
make test-hadolint-discovery # Test which files the Hadolint runner lints as Dockerfiles (every name the delivery templates build) only
make test-checkov # Test the Checkov IaC scanner tier (verified install, report verdict, advisory default, wiring on every platform) only
make test-codeql-scope # Test that a local CodeQL scan builds from the files git would ship, on every core, only
make test-codeql-gate # Test that CodeQL fails on findings `.codeql-false-positives` does not list, on every platform, and that the GitHub upload cannot fail the job, only
make test-dependency-check # Test the OWASP Dependency-Check NVD cache / API-key contract only
make test-dependency-track # Test the Dependency-Track BOM uploader (identity, isLatest gating, PR skip, retry of a briefly unreachable server, cross-platform wiring) only
make test-python-cyclonedx # Test static/non-distribution and dynamic Python SBOM versions, including resolution failures
make test-goreleaser-prepare # Test the GoReleaser main package detection only
make test-release-version-extraction # Test release version extraction (tag ref + bump commit) only
make test-release-reconcile # Test release reconciliation gap detection only
make test-release-promotion # Test release promotion (the tag run a bump merge now starts) only
make test-deploy-providers # Test the MVP hosting deployment providers (Cloudflare, Vercel, Render, Netlify, Fly.io) only
make test-memory-detection # Test the cgroup-aware memory ceiling detection only
make test-dart-pipeline # Test the Dart/Flutter pipeline (scripts, Semgrep rules, cross-platform wiring) only
make test-terra-pipeline # Test the Terraform/terra pipeline's CodeQL tool gap (GitHub, GitLab, Azure, terra.mk, terraform.mk) only
make test-javascript-pipeline # Test the JavaScript formatting gate (Prettier runner + cross-platform wiring) only
make test-phpmd # Test the PHPMD runner (the command line each major takes, the verdict, a report that stays JSON) only
make test-workflow-composition # Test the GitHub Actions workflow composition standard only
make test-working-directory # Test the `working_directory` threading contract (bundler/npm/yarn and their variants) only
make test-supply-chain # Test the supply-chain pinning contract (actions, images, binaries, packages) only
make test-runner-cache-gating # Test that no GitHub Actions cache restores into $HOME on a self-hosted runner only
make test-dependency-updates # Test the dependency-update tool's wiring (run.sh, report isolation, both workflows) only
make test-go-helpers # Run the Go helpers' unit tests (`go test ./...`; the dependency-update tool's behaviour, policy and command line)
make lint-go-helpers # Lint the Go helpers with the shared golden golangci-lint configuration (downloads the pinned golangci-lint)
make check-dependency-updates # Report which pinned dependencies have a newer release (network)
make apply-dependency-updates # Rewrite every stale pin in the working tree, digests included -- what the scheduled pull request carries (network)
make test-azure-step-names # Test Azure DevOps step-name uniqueness across expanded templates only
make test-azure-secret-env # Test that every Azure step consuming a credential maps it through `env:` only
make test-report-uploads # Test that no GitHub Actions report upload can fail its job, while mandatory reports stay enforced, only
make build-and-push NAME=<image> TAG=<tag> # Build and push a container image
make build NAME=<image> TAG=<tag> # Build both architectures, publish nothing (verification)
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago Changed · +40 lines · +1,606 tokens per session c16e79d88c7c
- 6d ago Changed · +1 lines · +35 tokens per session 50d10d1f0430
- 7d ago Changed · +51 lines · +1,453 tokens per session de070ff3ead9
- 8d ago Changed · +1 lines · +39 tokens per session 9be1f08d2ba6
- 12d ago Changed · +73 lines · +1,481 tokens per session 03786ba039e2
- 16d ago Changed · +52 lines · +3,110 tokens per session b43bba485065
- 17d ago Changed · +1 lines · +38 tokens per session f73d7a268eff
- 19d ago Changed · +28 lines · +1,100 tokens per session 7884ed0e3b14
- 20d ago Changed · +3 lines · +624 tokens per session 2aaf57590c5a
- 21d ago First seen · 909 lines · 22,876 tokens per session scan C 488067982edf
pipelines CLAUDE.md is an instructions file published in the GitHub repository rios0rios0/pipelines (25 stars, last pushed today), licensed MIT. It adds 32,362 tokens to every session, about $0.1294 per session on Opus 5.5. A static security scan graded it C with 2 findings (downloads and executes remote code, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other instructions, from other repositories
vscode buildNext.instructions.md
Working notes and architecture documentation for the new esbuild-based build system in build/next. Use when making changes to the new build pipeline (transpile/bundle commands, NLS plugin, source-map handling, resource copying, or self-hosting watch tasks).
next.js AGENTS.md
AGENTS.md instructions for vercel/next.js, covering next.js development guide, codebase structure, monorepo overview, core package: packages/next and other important packages.
vscode oss-third-party-notices.instructions.md
Instructions for microsoft/vscode, covering vs code oss third-party-notices pipeline, architecture, pipeline flow in ci, cache eligibility and rollout and applying the notice (cutover).
langchain AGENTS.md
AGENTS.md instructions for langchain-ai/langchain, covering global development guidelines for the langchain monorepo, corridor security analysis, project architecture and context, monorepo structure and development tools & commands.
vscode copilot-instructions.md
Copilot instructions for microsoft/vscode, covering vs code copilot instructions, project overview, root folders, core architecture (src/ folder) and built-in extensions (extensions/ folder).
vscode model-prompts.instructions.md
Model-specific prompt authoring and registry guidelines.