Français

Slides — Session 6: Claude Code & CI/CD

Program: Applied AI — Advanced Level — Instructor: Yann Isola
Format: 30 slides. Each slide includes the projected content then the speaker notes.
Palette: #1A2230 ink, #0F7A6C teal, #B4612A copper, #E9F6F3 light teal, #F4F7F6 background.

Slide 1 — Title

Claude Code & CI/CD

The agent in your terminal — then in your pipeline, at night, without you

Applied AI — Advanced Level — Session 6 — Yann Isola

Slide 2 — Quick reminder: Session 5

  • MCP (Model Context Protocol): connect standardized external tools
  • An MCP server = a security dependency to audit
  • The agentic loop: plan → act → observe → correct

Slide 3 — Objectives & certification issues

At the end of these 2.5 hours, you will know:

  1. Structure a CLAUDE.md that changes everything
  2. Lock permissions tool by tool (settings.json)
  3. Design hooks (PreToolCall, PostToolCall, Notification, Stop)
  4. Integrate Claude Code headless into a CI/CD pipeline
  5. Control costs and long sessions (/cost, /compact, caching)

🎓Heavily weighted domain on the Claude Certified Architect exam

Slide 4 — Claude Code, what is it?

An agentic coding assistant in the terminal

  • It doesn't talk about your code: it acts on it
  • Loop: read → plan → modify → execute → observe → correct
  • Instructions in natural language: “fix the VAT bug and add a test”
  • multi-file editions: reasons at the scale of the repository

Slide 5 — The metaphor in 4 steps (common thread of the session)

Component Role Metaphor
CLAUDE.md What he should do 🧠 The contextual brain
settings.json What he can do 🔒 The cage
Hooks What happens when he acts 📹 Cameras
Headless mode Unsupervised work 🏭 The Pipeline Worker

Slide 6 — He explores, he doesn’t “see” everything- Claude Code does not load the entire repository into memory

  • It explores on demand: Glob (file patterns), Grep (search), Read (read)
  • The context is built incrementally
  • Only exception: CLAUDE.md, loaded systematically

Slide 7 — Slash commands: the cockpit

  • /init — inspects the repository, generates a draft of CLAUDE.md
  • /review — starts a code review
  • /compactcompresses history (summary) → frees context
  • /cost — token consumption and session cost
  • Customized: .claude/commands/deploy-check.md/deploy-check

Slide 8 — Live demo 🎬

Project common thread: facturation-api

  1. claude then /init → CLAUDE.md generated
  2. “List the test files and tell me what is not covered”
  3. Observe: requests permission for every sensitive action

Slide 9 — CLAUDE.md: the contextual brain

  • Markdown file at the root, loaded at each session
  • = project system message, versioned with code, shared by the team
  • Analogy: the onboarding document of a new developer…
    …which he would reread entirely every morning, without ever forgetting anything

Slide 10 — The canonical structure

# facturation-api

## Overview
API REST de facturation — Python 3.12 / FastAPI / PostgreSQL.

## Conventions
- Docstrings in English, identifiers in English
- Montants TOUJOURS en centimes (entiers), jamais en flottants

## Commandes courantes
- Tests : poetry run pytest
- Lint : poetry run ruff check .

## Known pitfalls
- tests/integration/ exige : docker compose up -d db
- NEVER edit app/migrations/ by hand (Alembic)

Slide 11 — CLAUDE.md anti-patterns

  • ❌ The 800-line novel — consumes context, dilutes the critic. Target: < 150 lines
  • ❌ General points — “write clean code” = zero information
  • ❌ The outdated file — broken commands = time lost in each session
  • ✅ Treat it like code: review, update, designated owner

Slide 12 — Hierarchy of CLAUDE.md

  • ~/.claude/CLAUDE.mdglobal (personal preferences, all projects)
  • ./CLAUDE.mdproject (the essentials)
  • ./services/api/CLAUDE.mdsubfolder (monorepos)

The most specific complete the most general.

Slide 13 — [Exercise 1] then… the cage 🔒

Part C — Permissions & built-in tools

“The question is not: can we trust the model?
The question is: what scope have we given it?”

Slide 14 — The catalog of integrated tools

Tool Function Risk
Read, LS, Glob, Grep Explore, read 🟢 Low
TodoRead, TodoWrite Internal task list 🟢 Negligible
WebFetch Recover a web page 🟠 Medium
Write, Edit, MultiEdit Create/edit files 🟠 High
Bash Run from shell 🔴 Review
mcp__* External MCP Tools ⚪ Variable

Slide 15 — The three circles of permission

  1. 🟢 Free reading — explore costs nothing: Read, Glob, Grep, LS
  2. 🟠 Monitored writing — Write/Edit: validation or targeted reasons
  3. 🔴 Locked execution — Bash: fine-grained whitelist, command by command

Slide 16 — settings.json: allow / deny

{
  "permissions": {
    "allow": [
      "Read", "Glob", "Grep", "LS",
      "Bash(npm test:*)",
      "Bash(git diff:*)"
    ],
    "deny": [
      "Bash(rm:*)",
      "Bash(git push:*)"
    ]
  }
}

⚠ Exact syntax: see official doc of the day — the logic is stable

Slide 17 — What Claude Code cannot do

  • Leave the working directory without permission
  • Act without using a declared tool (everything is visible, logable)
  • Bypass a deny or a blocking hook

BUT — vector n°1 remains prompt injection:
A booby-trapped code comment or web page may contain instructions

Slide 18 — Lightning workshop: the configurator 🔧

Scenario: code review in CI — read only + comment

→ What tools in allow? Which ones in deny?
(permissions configurator — web page)

Slide 19 — Hooks: cameras 📹

A hook = YOUR script, executed automatically at key moments

  • Prompt → the model probably follows
  • Hook → the code executes every time, exactly as written

Determinist vs probabilistic: THE architect's distinction

Slide 20 — The 4 events of the life cycle

Event When Can block? Example
PreToolCall Before each tool call ✅ Yes Refuse psql to production
PostToolCall After each call ❌ No Reformat after each Edit
Notification Need for human attention ❌ No Ping Slack
Stop End of response/task ❌ No Archive log, notify

Slide 21 — The 3 families of hooks

  1. Guardrails (PreToolCall) — tamper-proof policies
    permissions = WHAT tools · hooks = WHAT uses
  2. Quality automation (PostToolCall) — lint, format, build check
  3. Observability (all) — complete audit log of each action

Slide 22 — Persuasion, capacity, control

Need Good level
“Comment in French” CLAUDE.md (persuasion)
“Never from git push deny permission (capacity)
psql OK except to prod-db” Hook PreToolCall (fine control)
“Reformat after editing” Hook PostToolCall (warranty)

Slide 23 — [Exercise 3] then… the pipeline employee 🏭

Part E — Headless & CI/CD mode

claude -p "Review this diff and list the security issues"
  • -p / --print: no interface, executes, prints, terminates
  • Exit code usable by the pipeline

Slide 24 — Headless: the golden rule

Headless, no one confirms.

  • Tool not pre-authorized → refusal → potentially incomplete task
  • So: permissions pre-calibrated in settings.json
  • And: strictly necessary for the task — he is an agent without supervision

❌ Absolute anti-pattern: “allows everything” on a runner with secrets

Slide 25 — Pattern 1: automatic PR review

PR ouverte → checkout → claude -p "revue du diff :
bugs, security, CLAUDE.md conventions" → comment on the PR
  • Permissions: read only + Bash(git diff:*)
  • Non-blocking at launch — complements the human, does not replace it
  • Timeout on the job = cost ceiling

Slide 26 — Patterns 2 & 3: tests and documentation

Test generation (coverage decreasing)

  • Permissions: read + Write + Bash(pytest:*)
  • 💍 Marriage permission + hook: Write authorized, hook PreToolCall checks that the path starts with tests/
  • Output: branch + PR, never direct push on main

Doc update (after merge on main)

  • Permissions: read + Edit limited to docs/
  • Output: Documentation PR

Slide 27 — Costs: the three reflexes

  1. /cost — visibility: tokens and session cost
  2. /compact — compress long history (summary) → healthy context
  3. Prompt caching — stable prefixes (CLAUDE.md, context) billed at a reduced rate ⚠ rate: daily price list

In CI: timeout + limit the size of diffs + reasoned triggers

Slide 28 — Workshop: the pipeline designer 🔧

Let's build the full flow:

PR → Claude Code review → Tests → Deployment

→ For each step: permissions, blocking/non-blocking, timeout
(pipeline designer — web page)

Slide 29 — The metaphor, completed

Component Role Nature
🧠 CLAUDE.md What he should do Probabilistic (persuasion)
🔒 settings.json What he can do Deterministic (capacity)
📹Hooks What happens when he acts Deterministic (control)
🏭 Headless Work without humans Pre-calibrated, least privilege

Slide 30 — Quiz, exit tickets, Session 7

  • ✅ Quiz: 10 multiple choice questions — certification threshold: 8/10
  • 📝 Exit ticket: an architectural decision to be applied tomorrow
  • 🏠 To submit: Complete exercise 2 (workflow + settings.json + architecture note)
  • 📅 Session 7: (announce the theme of the program)

Speaker notes: Welcome. Teasing: “Today we are hiring a colleague. He works in your terminal, he never sleeps, and at the end of the session he will be an employee of your CI/CD pipeline. The real question of the day: how to write your employment contract.” Announce the certification weight of this chapter.

Speaker notes: 90 seconds. Question to the room: “Who actually executes a tool call?” Expected response (Session 5 of the intermediate level, reworked): never the model, always your code. Today, this principle is embodied in a product: Claude Code.

Speaker notes: Clear contract. Make it clear that the exam tests *judgment* (scenarios), not rote flags. Each part ends with a standard certification question.

Speaker notes: Emphasize “agentic”: this is the loop of Session 3, embodied. Counterexample: autocompletion suggests the following line; Claude Code completes the *task*, including tests.

Speaker notes: THE slide to memorize. Announce: “the session plan is this table, line by line.” You will come back to this at the end. On the exam, many questions boil down to: what level (persuasion/capacity/control) for what need?

Speaker notes: Breaks a common preconception. Architect consequence: what you want him to *always* know must be in CLAUDE.md; the rest he will find when he needs it.

Speaker Notes: On custom commands: a Markdown file = a reusable prompt versioned with the project. Useful examples: production launch checklist, review template, migration procedure. It's team tools, not a gadget.

Speaker notes: 8 minutes max. The permission requests that appear are your Part C teaser: “note that I have to approve — who decides what gets rubber stamp?” Us, in 30 minutes.” If no network: Backup screenshots prepared.

Speaker Notes: The onboarding analogy works very well. Each line invested in CLAUDE.md saves dozens of downstream corrections — this is the best return on investment of all tooling.

Speaker notes: The 4 sections: overview, conventions, commands, gotchas. Emphasize *exact and copyable* commands: `poetry run pytest`, not “run tests”. Certification question: which section reduces execution errors the most? → the exact commands.

Speaker notes: Test of the generic file: “if this CLAUDE.md could describe any project, it does not describe yours.” You will reuse this test by correcting Exercise 1.

Speaker notes: Monorepo use case: different conventions between the front and the back. Transition exercise: “to you — 20 minutes to write the billing-api CLAUDE.md. The web builder can scaffold, but the final densification is manual.”

Speaker Notes: Slide pivot after exercise and break. Announce: the most important part of the session AND the trickiest in the exam. Slow down the pace.

Speaker notes: Chapter 13 of the guide. Build the leaderboard WITH the room before posting. `WebFetch` surprises in “medium”: unreliable web content = prompt injection vector, plus exfiltration possible. `Bash` unconstrained = SSH access given to the agent.

Speaker Notes: Simple mental model that solves 80% of scenario questions. Session 5 least privilege, applied to a coding agent.

Speaker Notes: Three rules: (1) patterns by command prefix — `Bash(git diff:*)` covers variants; (2) `deny` ALWAYS wins over `allow`; (3) the unlisted → interactive confirmation… or headless refusal. This third rule sets up Part E—set the scene now.

Speaker notes: The reassuring point AND the worrying point on the same slide, deliberately. The defense against injection is not “the model is smart” but “even manipulated, it CANNOT execute what is denied”. Permissions protect against manipulation of the model itself.

Speaker notes: 5 minutes, web page projected, the room votes. Response: Read/Glob/Grep/LS + `Bash(git diff:*)`, all else refused. Deliberate trap: someone will propose `Write` “to write the review” — no, the review goes out to standard output, it's the pipeline that posts the comment.

Speaker Notes: This distinction comes up in the exam in ten different forms. Wording to note: security policies go into hooks/permissions (deterministic), preferences and conventions in CLAUDE.md (probabilistic).

Speaker notes: Have the room verbalize one use case per event before showing the example column. PreToolCall subtlety: blocking sends a *message* to the model, which adjusts its strategy — it's a dialogue, not a silent wall.

Speaker notes: Family 3 speaks to participants in a regulated environment: the audit log of the agent's actions is what the auditor will ask for. A PostToolCall hook that logs tool + parameters + result = native auditability.

Speaker notes: THE reading grid for the exam. Typical question: “curl prohibited externally but allowed internally” → hook (conditional logic), not permission (too binary). Have a 2 minute debate then launch Exercise 3 (hook design — 15 min start time).

Speaker Notes: Transition after the hooks exercise. The same binary, a flag: the agent becomes a pipeline component. Ask the killer question: “Who clicks “allow” at 3 a.m. in a CI runner?” → person. Next slide.

Speaker notes: Almost certain question on exam (“job stops, tool refused, cause?” → missing permission). On the anti-pattern: if you really have to allow everything, it's disposable container + no outgoing network + zero secrets. Otherwise it's a flaw, not a pipeline.

Speaker notes: Strengths of the AI review: obvious bugs, conventions, error handling oversights. Weaknesses: business relevance, substantive architecture. Hence “non-blocking” – we harden it later, with supporting data, when the team trusts it.

Speaker notes: The “permission + hook marriage” is the most elegant pattern of the session: permission opens the capacity, the hook finely restricts it. This is exactly the bonus question in Exercise 2 — say it explicitly.

Speaker notes: Order of magnitude, without engraved number: “the cached token costs a fraction of the full token”. The real CI lever is not the price but the trigger discipline: revise each push of a PR of 40 commits = waste; revise upon opening + upon request = reasonable.

Speaker notes: 5 minutes in plenary with the web page, then launch the framework for Exercise 2 (to be completed at home, reread in Session 7). Check that each pair has chosen their pattern before letting them go.

Speaker notes: Return to slide 5, “nature” column in addition. Have a participant rephrase: “What goes where?” Security → never in the probabilistic. This is the sentence to take for the exam.

Speaker notes: Recommended flash oral quiz: Q2, Q5, Q9. Collect the exit tickets — they tell you what printed (and what didn't). Remember that Exercise 2 will be reread at the opening of Session 7: the fatal mistake “allows everything + secrets” caps the grade.