mirror of
https://github.com/agessaman/meshcore-bot.git
synced 2026-09-16 04:45:34 +00:00
agessaman
ad7df3438b
CONTRIBUTING covers dev setup, reproducing all six CI jobs locally, and the house rules a newcomer would otherwise trip over: append-only migrations, config changes needing config.ini.example updates, new docs pages needing an mkdocs nav entry, the ruff pin, and PRs targeting dev. SECURITY routes reports through GitHub private vulnerability reporting rather than an email address, with a 10-day acknowledgement and 30-day assessment window. Scope names what this codebase actually exposes, and explicitly puts the MeshCore protocol, RF-layer attacks, and running the viewer without a password out of scope. Issue forms collect the details every radio bug report needs — version, transport, hardware, install method — and the feature form asks up front whether a proposal spends mesh airtime. Blank issues stay enabled since Discussions is not turned on, so they are the only route for questions. Dependabot covers GitHub Actions weekly, where a stale or compromised action is a real supply-chain risk. pip and npm are grouped and monthly: runtime deps are >= ranges, so version updates are mostly floor bumps, and security fixes arrive through Dependabot alerts regardless.