AnthropicClaude Certified Architect – Foundations2026-103.6 Integrate Claude Code into CI/CD pipelines
Choose context loading for each CI job
Completed by the knowledge check
Learning objective
Retain project instructions in ordinary -p runs; recognize that --bare intentionally skips automatic CLAUDE.md, hooks, skills, plugins, and MCP discovery.
Core idea
Non-interactive execution and automatic context discovery are different decisions. An ordinary claude -p invocation loads the same configured context as an interactive session, including project instructions. Adding --bare deliberately changes that startup contract.
Choose the contract from the job’s dependencies. A team review that relies on checked-in conventions needs those conventions in context. A portable script that should ignore host customizations can use bare mode, but must supply the instructions and integrations it actually requires. Neither mode is a substitute for the permission policy in 3.6.1.
How it works
Keep ordinary project instructions available
For ordinary print runs, check out the repository and launch from the intended working directory. Project instructions can live in ./CLAUDE.md or ./.claude/CLAUDE.md. Claude Code loads instruction files in the directory hierarchy above the working directory at launch; instruction files in subdirectories load on demand.
This loading behavior matters in a monorepo. A job launched at the repository root should not assume every package’s nested instructions are already in context. Direct the reviewer to the relevant package files so its investigation reaches the applicable guidance. See 3.1.1 for instruction scope and 3.1.4 for diagnosing loading.
Ordinary -p also loads configured context from ~/.claude. A reusable runner can therefore supply personal instructions or customizations that a clean runner lacks. “It works on a developer machine” does not establish the context received by the CI invocation. Inspect the working directory, checked-out instructions, runner configuration, and launch flags together.
CLAUDE.md is guidance the model reads, not an enforced permission boundary. Writing “never deploy” there does not replace tool denials. Keep required operational gates in the job’s permissions or hooks; use the instruction file for project knowledge and review criteria.
Understand what bare mode skips
--bare skips automatic discovery of hooks, skills, custom commands, subagents, installed plugins, MCP servers, auto memory, and CLAUDE.md. The CLI reference states that it sets CLAUDE_CODE_SIMPLE; setting CLAUDE_CODE_SIMPLE=1 can therefore explain bare behavior even when the visible command lacks the flag.
A bare run still has Bash, file-read, and file-edit tools. Skipping configuration discovery does not mean that no tools exist or that all tool operations are approved. Continue to configure permissions and the tool menu explicitly.
There is a documented exception to the broad discovery rule: a directory supplied through --add-dir can contribute skills from its .claude/skills/ folder even in bare mode. Its .claude/commands/ and .claude/agents/ folders remain skipped. Bare mode skips automatic discovery; it does not make every skill unavailable.
Bare mode also changes authentication. It does not read OAuth credentials or the system keychain. For the Anthropic API, supply ANTHROPIC_API_KEY in the environment or an apiKeyHelper through --settings. The documented cloud providers continue to use their own provider credentials. A job that stops authenticating after adding --bare needs an explicit supported credential path, not a larger turn budget.
Supply bare-mode dependencies explicitly
The documented flags let you choose what a bare invocation receives:
| Dependency | Explicit mechanism |
|---|---|
| Extra system instructions | --append-system-prompt or --append-system-prompt-file |
| Settings | --settings |
| MCP servers | --mcp-config |
| Custom agents | --agents |
| A plugin | --plugin-dir or --plugin-url |
For example, a bare review can receive the repository’s standing instructions through a file flag:
claude --bare -p "Review the supplied diff against the project criteria" \
--append-system-prompt-file ./CLAUDE.md < pr.diffThe file flag supplies its contents as system-prompt additions. It does not restore automatic discovery of every other CLAUDE.md, hook, skill, or integration. If the job depends on separate package instructions, supply those deliberately too. Do not assume loading one text file recreates the complete ordinary session.
Appending preserves Claude Code’s default system prompt. --system-prompt and --system-prompt-file replace that prompt instead. Choose an append flag when you need project-specific additions while retaining the default coding-assistant guidance.
Account for hooks and MCP startup
Without bare mode, a -p session runs project hooks from .claude/settings.json and connects project MCP servers from .mcp.json, even in a folder it has never trusted. Print mode shows neither a workspace trust dialog nor a per-server approval prompt.
This is a load boundary, not a claim that each subsequent MCP tool call bypasses permissions. It explains why the job’s startup can differ when it reads different repository or host configuration. For a script intended to discover nothing implicitly, bare mode removes those dependencies; explicitly supplied MCP configurations or plugins remain intentional inputs.
Bare mode also prevents background tasks and omits system reminders normally supplied alongside tool results. If your workflow relies on those behaviors, treating bare mode as a performance-only flag is incorrect. Select the startup contract before tuning the job’s timing.
Key distinctions and trade-offs
Ordinary print mode reduces explicit setup when the repository already holds the required instructions and integrations. It also inherits configured context from the working directory and host. Bare mode makes dependencies more deliberate, but moves responsibility for supplying them into the invocation.
A fresh conversation is not an empty configuration. Ordinary print mode can load project instructions and auto memory into a fresh context window. Conversely, a bare invocation can receive substantial explicit context through prompts and flags. Distinguish conversation history from startup inputs; see 3.6.5 for review isolation.
Architecture / decision scenario
A CI test generator follows fixture rules in the repository’s CLAUDE.md. The first implementation uses ordinary -p from the checkout root and reads the relevant test files. After an optimization adds --bare, it starts proposing tests that ignore fixture conventions.
The team verifies the launch flags and finds that the instruction file is no longer discovered. It can retain ordinary print mode, or keep bare mode and supply --append-system-prompt-file ./CLAUDE.md plus any package guidance the assignment needs. It also supplies API authentication explicitly if bare mode removed reliance on subscription credentials. The decision restores the context dependency; repeating “follow project standards” without the standards does not.
Common exam traps
- Assuming
-palone disablesCLAUDE.mdloading. - Treating
--bareas a startup-speed change with no behavioral consequences. - Assuming a supplied root instruction file restores all automatic discovery.
- Confusing MCP connection at startup with approval of every MCP tool call.
- Forgetting
CLAUDE_CODE_SIMPLE=1when diagnosing bare behavior. - Expecting bare mode to use subscription OAuth credentials.
Where the exam guide differs
The exam guide names CLAUDE.md as the project-context mechanism for CI-invoked Claude Code without describing bare mode. Ordinary -p retains that behavior; --bare intentionally skips automatic instruction loading. Read an exam item about CLAUDE.md as an ordinary configured run unless it supplies a mode that disables discovery. The product documentation recommends bare mode for scripted calls, so check the invocation before relying on automatic project-context loading.
What to remember
Choose ordinary discovery or bare mode deliberately. Ordinary -p loads configured context; --bare skips it and requires explicit dependencies. Preserve project guidance through discovery or file-based prompt additions, then apply permissions independently. A missing context dependency is repaired by supplying that dependency, not by increasing retries.
Knowledge check
A CI test generator followed the fixture conventions in the repository’s CLAUDE.md until someone added --bare to speed it up. The team must keep bare mode. Which change restores the conventions?
--append-system-prompt-file ./CLAUDE.md to the job./CLAUDE.md to ./.claude/CLAUDE.md--max-turns so the job can find the conventionsCLAUDE.md , so the conventions must be supplied explicitly; the append flag adds the file’s contents to the system prompt. Naming the standards without their content supplies nothing, and ./.claude/CLAUDE.md is skipped by the same discovery rule.A review job authenticated through the runner’s Claude subscription login. After --bare was added, every run fails to authenticate against the Anthropic API. Which change fixes this?
--add-dir ~/.claude--max-turns and retry the failed runsANTHROPIC_API_KEY in the job’s environmentANTHROPIC_API_KEY or an apiKeyHelper supplied through --settings . A keychain entry is exactly what bare mode ignores, --add-dir does not supply credentials, and retries repeat the same failure.A claude -p review, run without --bare, follows the checked-in CLAUDE.md on a laptop but ignores it on a shared runner. Both start in the repository root, and the runner’s environment sets CLAUDE_CODE_SIMPLE=1. What is the most likely cause?
~/.claude replaces the project’s CLAUDE.md~/.claude supplies the instructions--bare works by setting CLAUDE_CODE_SIMPLE , so the variable explains bare behavior even though the command lacks the flag. Print mode shows no trust dialog, and personal configuration can add instructions alongside the project file; it does not explain why CLAUDE_CODE_SIMPLE=1 disables discovery on the runner.A CI job runs ordinary claude -p with Bash available. The team must deny direct Bash calls to kubectl apply. Which control enforces this?
CLAUDE.md forbidding kubectl apply--append-system-prompt forbidding kubectl applykubectl apply--bare flag that skips project configurationCLAUDE.md and appended system prompts are guidance the model reads, not permission boundaries; a deny rule is enforced on the call itself. Bare mode skips discovery but still provides Bash, so it does not enforce this denial.References
- Anthropic, Run Claude Code programmatically
- Anthropic, CLI reference
- Anthropic, How Claude remembers your project
- Anthropic, Claude Certified Architect – Foundations Exam Guide