Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/louisbrulenaudet/monorepo-templateWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/rules/louisbrulenaudet/monorepo-template/cd)<a href="https://agentmods.dev/rules/louisbrulenaudet/monorepo-template/cd"><img src="https://agentmods.dev/badge/rules/louisbrulenaudet/monorepo-template/cd/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/rules/louisbrulenaudet/monorepo-template/cd"><img src="https://agentmods.dev/badge/rules/louisbrulenaudet/monorepo-template/cd.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00000 | $0.03011 |
| Opus 5.5 | $0.00000 | $0.01204 |
| Sonnet 5.5 | $0.00000 | $0.00602 |
| Haiku 4.5 | $0.00000 | $0.00301 |
Grade A, and why
cd scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 57 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Continuous Deployment
The pipeline is .github/workflows/cd.yml; read it for the step list. How a release reaches it: release.mdc. Hardening, script conventions, and expression contexts: ci.mdc, which loads with every workflow - never diverge "just for CD". Human-facing secret/variable tables: the README deploy section. Worker secrets vs vars: workers-config.mdc.
Status
CD is paused until the production GitHub Environment secrets are configured. The pause is the repository variable CD_ENABLED, checked by release.yml's deploy job; set it to true in the same act as adding the secrets. It deliberately lives at the caller, not in this workflow: a job skipped inside a workflow_call target reports success to the caller, so a paused CD used to leave a green Release run with the tag cut and nothing shipped. Gating at the caller keeps the skip visible and workflow_dispatch usable for a manual redeploy.
Trigger
workflow_callandworkflow_dispatchonly.release.ymlcalls this workflow after cutting a tag it confirmed did not exist;workflow_dispatchtakes ataginput and is the redeploy / rollforward path.- No
push: tags:trigger; adding one is a regression. The release tag is created withGITHUB_TOKEN, whose events start no workflow runs (GitHubGITHUB_TOKENdocs; changesets/action#669, changesets/changesets#1545), so that trigger never fires. - Never deploy from
pull_requestorpull_request_target(the latter's base context plus an untrusted checkout is a pwn pattern). - Concurrency
cd-production,cancel-in-progress: false,queue: max: canceling would drop an in-flight ship, and with the defaultqueue: singlea third trigger replaces the pending one, silently losing that release. - Checkout
ref: refs/tags/${{ inputs.tag }}: the ship matches the tagged commit, not the branch tip at job start, and the qualified ref stops a same-named branch shadowing the tag.Resolve release versionfails unless that commit is onmain(compare API), so neither a dispatch nor a moved tag ships an ungated commit. The tag must be exactlyvX.Y.Z: a changesets pre-mode tag (v1.0.0-next.0) fails closed there instead of shipping at 100%, by design.RELEASE_SHA(the tagged commit) is what upload messages and Release notes record;GITHUB_SHApoints at the dispatching ref on redeploys. - The build step is also the type gate:
pnpm turbo run check-types build --filter='./apps/*...'.builddoes not depend oncheck-typesand this job has no remote cache, so droppingcheck-typeswould upload bundles no step type-checked. Uploads are--prebuilt: they ship exactly the Build Output (apps/<app>/.cloudflare/output/) this step wrote, in the mode it recorded. The trailing...pulls in the internal packages the apps ship, and expands that way only whilefutureFlags.filterUsingTasksstays off (turborepo.mdc).
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today Changed · +1 lines b45c06d1fff4
- 20d ago Changed 27a1baa39fc4
- 22d ago Changed b2b79b8fcbee
- 23d ago Changed · -5 lines c0bc174c2721
- 24d ago Changed bc1d77d54833
- 25d ago Changed · +1 lines d209e9948a64
- 27d ago Changed bbc7de77b0a7
- 1mo ago First seen · 60 lines · 0 tokens per session scan A be7eb6cbfb47
cd is a cursor rule published in the GitHub repository louisbrulenaudet/monorepo-template (19 stars, last pushed today), licensed Apache-2.0. It costs nothing until one of its globs matches a file; then it loads 3,011 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other cursor rules, from other repositories
mcp-releasing
Steps and procedures for releasing MCP (Model Context Protocol) servers as NPM packages.
add-to-changelog
Update the project's CHANGELOG.md file with a new entry.
changelog-generator-manual
This rule generates a comprehensive changelog.md file by analyzing all git tags and commits, creating a chronological record of all project changes with proper semantic versioning structure. The changelog.md file is stored at the root of the project.
release-commit-analysis-auto
This rule analyzes commits to determine if they should trigger a version bump. It categorizes conventional and non-conventional commits into Features, Bug Fixes, Breaking Changes, Documentation, and Other. It uses intelligent keyword matching for non-conventional commits and analyzes file changes to help categorize…
release-git-tags-auto
This rule checks for existing tags before creating new ones. It also offers to push the tag to the remote repository. It runs when users request release creation, version bumping, or package publishing.
release-validation-auto
This rule validates release prerequisites including branch naming conventions and package.json structure. It runs when users request release creation, version bumping, or package publishing. The rule ensures releases only occur from appropriate branches (release/, hotfix/, fix/) and validates package.json exists with…