Contributing

Bug reports and focused patches are welcome. Include the app version, watch model, reproduction steps, and expected and actual behavior. Use fabricated entries in examples, logs and screenshots. See SECURITY.md for vulnerability reports.

Development

Follow the Docker setup in the README and the developer guide. Use make test-tools for Python tooling changes, make test for application tests, make lint for static checks, and make docs for documentation. UI changes should also pass make screenshots; review image differences before approving new golden images. Before a release, run make ci ALL=1 for the full device matrix. Routine checks default to fr70.

Describe what changed and how you verified it. Keep expensive work in resumable jobs and preserve the app's no-network-permissions design. The project plan preserves the original numbered design sections referenced in source comments and historical changelog entries.

Secrets and private data

Never commit signing keys, Garmin credentials, SDK/device downloads, real OTP seeds, authenticator exports, watch storage dumps, or screenshots containing real accounts or barcodes. .gitignore covers common filenames, but cannot identify every private file. Keep personal test data outside this checkout. The checked-in fixtures use published RFC keys and fabricated accounts; they must never be used for real accounts.

Install Gitleaks v8.25.0 or newer for secret scanning. Scan all reachable history before publishing:

gitleaks git --log-opts=--all --redact --no-banner .

Optionally enable the staged-file check for each commit (requires Gitleaks on the host):

git config core.hooksPath .githooks

The checked-in configuration extends Gitleaks' default detectors and allows only specific reviewed test values in specific fixture files. Review new findings; do not suppress a whole test folder. Git history also preserves deleted data and commit author emails. If a real credential is committed, revoke or rotate it before arranging history cleanup.

Licensing

By submitting a contribution, you agree to license your original work under GPL-3.0-only, as described in LICENSE. Preserve upstream notices when using third-party material and update THIRD_PARTY_NOTICES.md. Garmin's SDK and device files have their own terms and must not be added to the repository.

When distributing a binary, include the license and upstream notices copied into build/package/ by make package, and provide the corresponding source, including build scripts and any modifications. A Store upload alone does not supply that source: publish the matching source version and make its location available to recipients.