Moved my coding rules out of CLAUDE.md and into CI. Escape every echo, no database calls from components, no inline styles: each is now a semgrep check that fails the PR. A rule Claude reads is a suggestion. A rule CI runs is a rule.
Webmentions
1 like - Piekwerk October 27, 2026
I did the same move and what made it stick was feeding the checks back to the agent. The same semgrep rules run from a PostToolUse hook, so Claude hits the violation right after the edit and fixes it itself. CI stays the backstop. Without it I was the one repairing every failed run.
- nark3d October 27, 2026
Which rule broke first when you moved them over: the ones semgrep can express as a pattern, or the ones that only made sense as a sentence to a reader? I'd guess the inline styles check is easy and the echo rule needed rewriting before it could fail anything.
- Edmund White October 27, 2026
You called it. The echo rule was a regex at first and missed ??, ternaries and concatenation, so it became an AST pattern with an allowlist. What stayed a sentence is the why: CLAUDE.md now just explains each rule, CI enforces it.
