Platform to programmatically author, schedule and monitor workflows.
Covers naming, the security model, commit form, and when to open a pull request instead of an issue.
This file points the agent at 18 other documents in the repository. Open any of them to read it here, as it was at this commit.
├── .github │ └── instructions │ └── ├── airflow-core │ └── docs │ └── security │ ├── │ └── ├── airflow-ctl │ └── ├── contributing-docs │ ├── │ ├── │ ├── │ ├── │ ├── │ ├── │ └── ├── dev │ ├── breeze │ │ └── doc │ │ ├── adr │ │ │ └── │ │ └── ci │ │ └── │ ├── │ └── ├── providers │ ├── <provider> │ │ └── docs │ │ └── changelog.rst — the changed provider's changelog │ └── └──
File measured on main at commit 485107f. Analysis written 2026-09-14. Star count is a snapshot from September 2026.
The broadest file in the directory. Alongside structure and commands it covers how to spell one domain term, how to classify a security finding, what a newsfragment is for, how the git remotes must be named, and what an agent may put in a commit trailer.
Quoted lines are verbatim from the file. Open one to see it where it sits.
House vocabulary
The term is written in title case in all prose. The carve-out covers literal code tokens, which keep their original spelling even inside fenced code blocks, and includes a further exception for anti-pattern quotes that show the wrong form in order to teach the rule.
Three categories are defined for anything the agent might flag: actual vulnerabilities that violate the documented security model, known limitations that are already tracked, and deployment hardening that belongs in operator guidance rather than as a code issue. The authoritative document is linked, including its chapter on what is not considered a vulnerability.
Contribution etiquette
When the fix is already known, the file directs the agent past filing an issue. Two reasons are given: the PR already carries the title, description, diff and discussion, and an open issue attracts duplicate submissions. The exception is a workaround whose real fix is deferred, where the issue outlives the PR.
A workaround, version cap or partial fix requires a tracking issue opened before the PR body is finalised, referenced by number in the PR, and linked at the workaround site in the code. The link is specified as a full URL rather than a bare number, because bare references do not resolve outside GitHub's web interface.
Hard prohibitions
The commit section ends with a line prohibiting the agent from adding itself as a co-author, with the stated distinction that agents are assistants rather than authors. A separate PR template field discloses the agent by name and version instead.
Two remote names are fixed by convention. The agent is told to run git remote -v before any remote command, and where the names do not match, to surface the mismatch and propose the exact rename commands rather than silently working with what is there.
Tests are to cover exactly what the PR changes: every changed behavior gets a test, every test must fail without the change, and tests for pre-existing logic or third-party functions are excluded.
Airflow's file tells an agent how the codebase works. It cannot tell it which bug three customers hit this week. Modem keeps that context current and attaches it to the work.