jcoffey-dev
9c44a28197
It had none: no security policy, no contributing guide, no code of conduct, no sponsor link, and no CI. A public repository with an administrative interface in it should at least say where to send a vulnerability, so that part names what is worth reporting here specifically -- a session acting beyond its permissions, one tenant's data reaching another, a token landing somewhere that outlives the session -- and where a report goes if it turns out to belong to the server or to upstream. CI is what a contributor can run: typecheck, lint, test, build. Nothing in it needs a live server, so a red run means the code, not the runner.
30 lines
939 B
Markdown
30 lines
939 B
Markdown
# Contributing
|
|
|
|
Patches, bug reports and questions are welcome. Open an issue first for
|
|
anything substantial; small fixes need no ceremony.
|
|
|
|
## What this is
|
|
|
|
A fork of Stalwart's web interface, taken under the AGPL-3.0-only half of its
|
|
dual licence, talking to INBUXA over JMAP and OAuth. Upstream's copyright
|
|
headers stay where they are, and a file this fork has changed says so beneath
|
|
them. New files carry Coffey Labs' own header and `AGPL-3.0-only`.
|
|
|
|
Changes to files that came from upstream are kept small, so the next import
|
|
merges cleanly and a reader can tell fork from base.
|
|
|
|
## Before you push
|
|
|
|
```
|
|
npm ci
|
|
npm run typecheck && npm run lint && npm test && npm run build
|
|
```
|
|
|
|
CI runs exactly that. Nothing here talks to a live server, so a failing test
|
|
is a real failure rather than a missing container.
|
|
|
|
## Commit messages
|
|
|
|
Say what changed and why, in prose. The why is the part that is hard to
|
|
recover later. No tool trailers.
|