mirror of
https://github.com/agessaman/meshcore-bot.git
synced 2026-09-25 09:03:36 +00:00
agessaman
ad7df3438b
CONTRIBUTING covers dev setup, reproducing all six CI jobs locally, and the house rules a newcomer would otherwise trip over: append-only migrations, config changes needing config.ini.example updates, new docs pages needing an mkdocs nav entry, the ruff pin, and PRs targeting dev. SECURITY routes reports through GitHub private vulnerability reporting rather than an email address, with a 10-day acknowledgement and 30-day assessment window. Scope names what this codebase actually exposes, and explicitly puts the MeshCore protocol, RF-layer attacks, and running the viewer without a password out of scope. Issue forms collect the details every radio bug report needs — version, transport, hardware, install method — and the feature form asks up front whether a proposal spends mesh airtime. Blank issues stay enabled since Discussions is not turned on, so they are the only route for questions. Dependabot covers GitHub Actions weekly, where a stale or compromised action is a real supply-chain risk. pip and npm are grouped and monthly: runtime deps are >= ranges, so version updates are mostly floor bumps, and security fixes arrive through Dependabot alerts regardless.
1.2 KiB
1.2 KiB
What this changes
Why
Testing
Checklist
- Branched from
devand targetingdev make testpassesmake lintpasses (ruff + mypy)- Frontend lint passes if templates changed (
npm run lint:frontend) - Tests added or updated for behavior changes
CHANGELOG.mdupdated under## [Unreleased]if user-visible- Config changes are reflected in
config.ini.example(and the minimal/quickstart templates where relevant) — CI validates these withvalidate_config.py --strict - New docs pages are added to
nav:inmkdocs.yml - Any new command justifies its airtime and defaults conservatively