agentmods.dev

pipelines: Instructions file for GitHub Copilot

.github/copilot-instructions.md

pipelines copilot-instructions.md is an instructions file for GitHub Copilot from rios0rios0/pipelines. It costs 15,106 tokens per session, scanned D, original, MIT.

A repository guide for CI/CD pipeline templates, which automate building, testing, and releasing software across systems such as GitHub Actions, GitLab CI, and Azure DevOps.

In plain words
What is it for?
It helps maintain pipeline templates, run the repository's test suites, check dependency and toolchain compatibility, and validate release, deployment, security, and infrastructure workflows.
Why use it?
It gives contributors a common reference for validation commands and supply-chain rules across templates for many programming languages and tools.

Instructions file for GitHub Copilot

Written for GitHub Copilot: a Copilot instructions file. Also seen: mentions CLAUDE.md; positional $N argument.

This is rios0rios0/pipelines's own configuration. It tells GitHub Copilot how to work on pipelines itself, so it is not a mod to install elsewhere. Copy it as a starting point and replace the rules that are about this project. Everything pipelines configures →

Needs its repository: it runs a file that does not travel with it, so clone the repository first. The line is bash global/scripts/shared/cleanup.sh # Works - 0.004s.

not rated 25repo changed 5d ago D scan 15,106 tokens original MIT
View source ↗ rios0rios0/pipelines
Reuse

Borrowing it

Nothing to install: this file belongs to rios0rios0/pipelines. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file
curl -O https://raw.githubusercontent.com/rios0rios0/pipelines/main/.github/copilot-instructions.md
Clone the repo
git clone --depth 1 https://github.com/rios0rios0/pipelines

Made for: GitHub Copilot.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for pipelines copilot-instructions.md

README.md
[![agentmods](https://agentmods.dev/badge/instructions/rios0rios0/pipelines/copilot-instructions/github.svg)](https://agentmods.dev/instructions/rios0rios0/pipelines/copilot-instructions)
Your own site
<a href="https://agentmods.dev/instructions/rios0rios0/pipelines/copilot-instructions"><img src="https://agentmods.dev/badge/instructions/rios0rios0/pipelines/copilot-instructions/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for pipelines copilot-instructions.md

Your own site · 80×15
<a href="https://agentmods.dev/instructions/rios0rios0/pipelines/copilot-instructions"><img src="https://agentmods.dev/badge/instructions/rios0rios0/pipelines/copilot-instructions.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 15,106 This file is loaded in full into every session.
When invoked 15,106 The same file — it is already loaded in full.
Security scan D 3 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.15106 $0.15106
Opus 5.5 $0.06042 $0.06042
Sonnet 5.5 $0.03021 $0.03021
Haiku 4.5 $0.01511 $0.01511

Measured 5d ago against content hash 9edcda7a8736, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade D, and why

pipelines copilot-instructions.md scanned grade D with 3 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Downloads and executes remote codehighSupply chain

curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.

fetch through `download_verified` from `verify-download.sh`. Never `curl | sh`, and never an unverified

Unrestricted tool accessmediumExcessive agency

A wildcard tool grant or "run any command" leaves no least-privilege boundary at all.

# Run any script

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

fetch through `download_verified` from `verify-download.sh`. Never `curl | sh`, and never an unverified
.github/copilot-instructions.md · 1,043 lines

How it starts

The opening of the file, as written. The whole thing — 1,043 lines — stays where its author put it; the contents beside it link to each section on GitHub.

CI/CD Pipeline Templates Repository

ALWAYS FOLLOW THESE INSTRUCTIONS FIRST. Only fallback to additional search and context gathering if the information in these instructions is incomplete or found to be in error.

This repository provides comprehensive SDLC pipeline templates for GitHub Actions, GitLab CI, and Azure DevOps across multiple programming languages including GoLang, Java, Python, JavaScript, PHP, Ruby, .NET, Dart/Flutter, and Terraform/Terra.

Quick Reference

Essential Commands:

  • make test - Run all validation tests (Go helpers, Go, go-module-toolchain, CycloneDX main detection, Go cache trim, Lambda, YAML merge, SonarQube, release tag, tftest-gen, terra-coverage, order-check, var-catalog, terraform-validate, terraform-provider-mirror, terra-test-roots, terra-install, docker-multi-arch, basic-checks, fixture-isolation, gitignore, hadolint-discovery, checkov, dependency-check, dependency-track, goreleaser-prepare, release-version-extraction, release-reconcile, release-promotion, deploy-providers, memory-detection, dart-pipeline, javascript-pipeline, phpmd, terra-pipeline, workflow-composition, working-directory, supply-chain, runner-cache-gating, dependency-updates, azure-step-names, azure-secret-env, containers-detect, report-uploads)
  • make test-go-script - Test Go script changes specifically
  • make test-go-module-toolchain - Test that every go.mod toolchain directive is readable by the images/analysers that consume it specifically
  • make test-go-tool-staleness - Test that a source-built Go tool (govulncheck) is rebuilt when its toolchain/pin moves specifically
  • make test-govulncheck-verdict - Test that govulncheck fails on a vulnerability the code calls, read from its report rather than the -json exit code, specifically
  • make test-go-tmpdir-modcache - Test that the Go module cache stays out of $TMPDIR specifically
  • make test-go-integration-scope - Test which packages the Go runner's integration phase selects specifically
  • make test-lambda - Test Lambda template validation specifically
  • make test-yaml-merge - Test golangci-lint/run.sh (YAML config merge, binary reuse and install, toolchain guard) specifically
  • make test-sonarqube - Test SonarQube auto-derivation and the retry of a scanner run the server broke specifically
  • make test-release-tag-idempotency - Test release tag idempotency specifically
  • make test-tftest-gen - Test tftest-gen generator specifically
  • make test-terra-coverage - Test the Terraform generic coverage report generator specifically
  • make test-order-check - Test the Terragrunt file-ordering checker/fixer specifically
  • make test-var-catalog - Test the shared variable-declaration generator specifically
  • make test-terraform-validate - Test the root-module terraform validate tier specifically
  • make test-terraform-provider-mirror - Test the local Terraform provider mirror specifically
  • make test-terra-test-roots - Test the terra-test tier's opt-in root-module run (TERRA_TEST_ROOTS) specifically
  • make test-terra-install - Test the terra CLI installer (pin check, installs that run together on one HOME, Azure DevOps step stops at a failed install) specifically
  • make test-docker-multi-arch - Test 40-delivery/docker multi-arch contract specifically
  • make test-build-version - Test the version build argument (shared helper, GitHub image delivery, Fly.io deploy, Go workflow wiring) and the delivered image's way to the Fly.io deploy specifically
  • make test-containers-detect - Test the Container Images change detection (deleted/renamed folders, dispatch inputs) specifically
  • make test-basic-checks - Test basic-checks changelog validation (chlog fragments + legacy CHANGELOG.md) specifically
  • make test-fixture-isolation - Test that every suite builds its fixtures in mktemp space and guards every cd specifically
  • make test-gitignore - Test the shared .gitignore block generator specifically
  • make test-sast-gate - Test that make sast and every individual SAST target propagate tool failures specifically
  • make test-hadolint-discovery - Test which files the Hadolint runner lints as Dockerfiles (every name the delivery templates build) specifically
  • make test-checkov - Test the Checkov IaC scanner tier (verified install, report verdict, advisory default, wiring on every platform) specifically
  • make test-codeql-scope - Test that a local CodeQL scan builds from the files git would ship, on every core, while CI keeps the checkout and one thread, specifically
  • make test-dependency-check - Test the OWASP Dependency-Check NVD cache / API-key contract specifically
  • make test-dependency-track - Test the Dependency-Track BOM uploader (identity, isLatest gating, PR skip, retry of a briefly unreachable server, cross-platform wiring) specifically
  • make test-goreleaser-prepare - Test the GoReleaser main package detection specifically
  • make test-release-version-extraction - Test release version extraction (tag ref + bump commit) specifically
  • make test-release-reconcile - Test release reconciliation gap detection specifically
  • make test-release-promotion - Test release promotion (the tag run a bump merge now starts) specifically
  • make test-deploy-providers - Test the MVP hosting deployment providers (Cloudflare, Vercel, Render, Netlify, Fly.io) specifically
  • make test-memory-detection - Test the cgroup-aware memory ceiling detection specifically
  • make test-dart-pipeline - Test the Dart/Flutter pipeline (scripts, Semgrep rules, cross-platform wiring) specifically
  • make test-javascript-pipeline - Test the JavaScript formatting gate (Prettier runner + cross-platform wiring) specifically
  • make test-phpmd - Test the PHPMD runner (the command line each major takes, the verdict, a report that stays JSON) specifically
  • make test-terra-pipeline - Test the Terraform/terra pipeline's CodeQL tool gap (GitHub, GitLab, Azure, terra.mk, terraform.mk) specifically
  • make test-workflow-composition - Test the GitHub Actions workflow composition standard specifically
  • make test-working-directory - Test that the working_directory input is declared, forwarded and threaded to every project-scoped step -- and kept away from the repository-wide scanners -- specifically
  • make test-supply-chain - Test the supply-chain pinning contract (actions, images, binaries, packages) specifically
  • make test-runner-cache-gating - Test that no GitHub Actions cache restores into $HOME on a self-hosted runner specifically
  • make test-dependency-updates - Test the dependency-update checker specifically
  • make test-go-helpers - Run the Go helpers' unit tests (go test ./... over the root module; offline)
  • make lint-go-helpers - Lint the Go helpers with the shared golden golangci-lint configuration (downloads the pinned golangci-lint)
  • make test-azure-step-names - Test Azure DevOps step-name uniqueness across expanded templates specifically
  • make test-azure-secret-env - Test that every Azure DevOps step consuming a credential maps it through env: specifically
  • make test-report-uploads - Test that no GitHub Actions report upload can fail its job, while mandatory reports stay enforced, specifically
  • make check-dependency-updates - Report which pinned dependencies have a newer release (hits the network)
  • make apply-dependency-updates - Rewrite every stale pin in the working tree, digests and inline copies included -- what the scheduled pull request carries (hits the network; commits nothing)
  • bash global/scripts/shared/cleanup.sh - Clean up build reports
  • docker --version && make --version && go version - Check dependencies

Read the full file on GitHub · 1,043 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 5d ago Changed · +158 tokens per session 9edcda7a8736
  2. 6d ago Changed · +1 lines · +7 tokens per session 752812cb312e
  3. 7d ago Changed · +2 lines · +53 tokens per session af4cd1329a37
  4. 8d ago Changed · +2 lines · +47 tokens per session 1d8d97f8337c
  5. 12d ago Changed · +13 lines · +452 tokens per session 2f1ff61b41c9
  6. 16d ago Changed · +21 lines · +457 tokens per session 7feb5ffd6c03
  7. 17d ago Changed · +2 lines · +67 tokens per session 863acf1dc8bf
  8. 19d ago Changed · +8 lines · +201 tokens per session e89be3b31fad
  9. 20d ago Changed · +2 lines · +201 tokens per session d89668364634
  10. 25d ago First seen · 992 lines · 13,463 tokens per session scan D 775ac6a02c91

Subscribe to this mod's changes

pipelines copilot-instructions.md is an instructions file published in the GitHub repository rios0rios0/pipelines (25 stars, last pushed today), licensed MIT. It adds 15,106 tokens to every session, about $0.0604 per session on Opus 5.5. A static security scan graded it D with 3 findings (downloads and executes remote code, unrestricted tool access, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

CI and CDDevOps and cloudazure-devopsgithub-actionsgitlab-ci
Related

Other instructions, from other repositories

vscode buildNext.instructions.md

Working notes and architecture documentation for the new esbuild-based build system in build/next. Use when making changes to the new build pipeline (transpile/bundle commands, NLS plugin, source-map handling, resource copying, or self-hosting watch tasks).

microsoft/vscode · 9,715 tokens

next.js AGENTS.md

AGENTS.md instructions for vercel/next.js, covering next.js development guide, codebase structure, monorepo overview, core package: packages/next and other important packages.

vercel/next.js · 7,461 tokens

vscode oss-third-party-notices.instructions.md

Instructions for microsoft/vscode, covering vs code oss third-party-notices pipeline, architecture, pipeline flow in ci, cache eligibility and rollout and applying the notice (cutover).

microsoft/vscode · 5,262 tokens

langchain AGENTS.md

AGENTS.md instructions for langchain-ai/langchain, covering global development guidelines for the langchain monorepo, corridor security analysis, project architecture and context, monorepo structure and development tools & commands.

langchain-ai/langchain · 4,680 tokens

vscode copilot-instructions.md

Copilot instructions for microsoft/vscode, covering vs code copilot instructions, project overview, root folders, core architecture (src/ folder) and built-in extensions (extensions/ folder).

microsoft/vscode · 2,731 tokens

vscode model-prompts.instructions.md

Model-specific prompt authoring and registry guidelines.

microsoft/vscode · 2,022 tokens