Borrowing it
Nothing to install: this file belongs to rios0rios0/pipelines. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/rios0rios0/pipelines/main/CLAUDE.mdgit clone --depth 1 https://github.com/rios0rios0/pipelinesWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/instructions/rios0rios0/pipelines/claude-md)<a href="https://agentmods.dev/instructions/rios0rios0/pipelines/claude-md"><img src="https://agentmods.dev/badge/instructions/rios0rios0/pipelines/claude-md.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.20115 | $0.20115 |
| Opus 5 | $0.10057 | $0.10057 |
| Sonnet 5 | $0.04023 | $0.04023 |
| Haiku 4.5 | $0.02012 | $0.02012 |
Grade C, and why
pipelines CLAUDE.md scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Downloads and executes remote codehighSupply chain
curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.
- `terraform/tflint/install.sh` and `terraform/terra/install.sh` — pinned, checksum-verified installers that replaced the vendors' `curl … | sh` one-liners on all three platforms Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
- `terraform/tflint/install.sh` and `terraform/terra/install.sh` — pinned, checksum-verified installers that replaced the vendors' `curl … | sh` one-liners on all three platforms How it starts
The opening of the file, as written. The whole thing — 795 lines — stays where its author put it; the contents beside it link to each section on GitHub.
CLAUDE.md
This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
What This Is
A CI/CD pipeline templates library providing reusable workflows for GitHub Actions, GitLab CI, and Azure DevOps across Go, Python, Java, JavaScript, PHP, Ruby, .NET, Dart/Flutter, Terraform, and Terra CLI. This is not a runnable application — it provides templates and scripts consumed by other projects.
Commands
make test # Run all validation tests (Go, go-module-toolchain, CycloneDX main detection, Go cache trim, Lambda, YAML merge, SonarQube, release tag, tftest-gen, order-check, var-catalog, terraform-validate, terraform-provider-mirror, docker-multi-arch, basic-checks, gitignore, dependency-check, dependency-track, goreleaser-prepare, release-version-extraction, release-reconcile, deploy-providers, memory-detection, dart-pipeline, javascript-pipeline, terra-pipeline, workflow-composition, working-directory, supply-chain, runner-cache-gating, azure-step-names, dependency-updates, containers-detect)
make test-go-script # Test Go validation script only
make test-go-module-toolchain # Test that every go.mod toolchain directive is readable by the images/analysers that consume it only
make test-go-tool-staleness # Test that a source-built Go tool (govulncheck) is rebuilt when its toolchain/pin moves only
make test-go-tmpdir-modcache # Test that the Go module cache stays out of $TMPDIR only
make test-go-integration-scope # Test which packages the Go runner's integration phase selects only
make test-lambda # Test Lambda template validation only
make test-yaml-merge # Test YAML merge validation only
make test-sonarqube # Test SonarQube auto-derivation only
make test-release-tag-idempotency # Test release tag idempotency only
make test-tftest-gen # Test tftest-gen generator only
make test-order-check # Test the Terragrunt file-ordering checker/fixer only
make test-var-catalog # Test the shared variable-declaration generator only
make test-terraform-validate # Test the root-module `terraform validate` tier only
make test-terraform-provider-mirror # Test the local Terraform provider mirror only
make test-docker-multi-arch # Test 40-delivery/docker multi-arch contract only
make test-containers-detect # Test the Container Images change detection (deleted/renamed folders, dispatch inputs) only
make test-basic-checks # Test basic-checks changelog validation (chlog fragments + legacy CHANGELOG.md) only
make test-gitignore # Test the shared .gitignore block generator only
make test-dependency-check # Test the OWASP Dependency-Check NVD cache / API-key contract only
make test-dependency-track # Test the Dependency-Track BOM uploader (identity, isLatest gating, PR skip, cross-platform wiring) only
make test-goreleaser-prepare # Test the GoReleaser main package detection only
make test-release-version-extraction # Test release version extraction (tag ref + bump commit) only
make test-release-reconcile # Test release reconciliation gap detection only
make test-deploy-providers # Test the MVP hosting deployment providers (Cloudflare, Vercel, Render, Netlify, Fly.io) only
make test-memory-detection # Test the cgroup-aware memory ceiling detection only
make test-dart-pipeline # Test the Dart/Flutter pipeline (scripts, Semgrep rules, cross-platform wiring) only
make test-terra-pipeline # Test the Terraform/terra pipeline's CodeQL tool gap (GitHub, GitLab, Azure, terra.mk, terraform.mk) only
make test-javascript-pipeline # Test the JavaScript formatting gate (Prettier runner + cross-platform wiring) only
make test-workflow-composition # Test the GitHub Actions workflow composition standard only
make test-working-directory # Test the `working_directory` threading contract (bundler/npm/yarn and their variants) only
make test-supply-chain # Test the supply-chain pinning contract (actions, images, binaries, packages) only
make test-runner-cache-gating # Test that no GitHub Actions cache restores into $HOME on a self-hosted runner only
make test-dependency-updates # Test the dependency-update checker only
make check-dependency-updates # Report which pinned dependencies have a newer release (network)
make test-azure-step-names # Test Azure DevOps step-name uniqueness across expanded templates only
make build-and-push NAME=<image> TAG=<tag> # Build and push a container image
make build NAME=<image> TAG=<tag> # Build both architectures, publish nothing (verification)
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today Changed · +2 lines · +59 tokens per session 570ce3b8acb8
- yesterday Changed · +1 lines · +21 tokens per session abc99d8f1743
- 2d ago Changed · +9 lines · +194 tokens per session 10a880798607
- 3d ago Changed · +31 tokens per session 01f186452cc6
- 8d ago First seen · 783 lines · 19,810 tokens per session scan C 00cda96c15b5
pipelines CLAUDE.md is an instructions file published in the GitHub repository rios0rios0/pipelines (22 stars, last pushed today), licensed MIT. It adds 20,115 tokens to every session, about $0.1006 per session on Opus 5. A static security scan graded it C with 2 findings (downloads and executes remote code, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other instructions, from other repositories
codex AGENTS.md
AGENTS.md instructions for openai/codex, covering rust/codex-rs, the codex-core crate, code review rules, crate api surface and model visible context.
vscode buildNext.instructions.md
Working notes and architecture documentation for the new esbuild-based build system in build/next. Use when making changes to the new build pipeline (transpile/bundle commands, NLS plugin, source-map handling, resource copying, or self-hosting watch tasks).
next.js AGENTS.md
AGENTS.md instructions for vercel/next.js, covering next.js development guide, codebase structure, monorepo overview, core package: packages/next and other important packages.
langchain AGENTS.md
AGENTS.md instructions for langchain-ai/langchain, covering global development guidelines for the langchain monorepo, corridor security analysis, project architecture and context, monorepo structure and development tools & commands.
vscode oss-third-party-notices.instructions.md
Instructions for microsoft/vscode, covering vs code oss third-party-notices pipeline, architecture, pipeline flow in ci, applying the notice (cutover) and fallback chain (never fail the build).
spec-kit AGENTS.md
AGENTS.md instructions for github/spec-kit, covering agents.md, about spec kit and specify, quickstart — add a new integration in 5 steps, integration architecture and integrationmanifest — file tracking.