diff options
Diffstat (limited to 'CONTRIBUTING.md')
| -rw-r--r-- | CONTRIBUTING.md | 37 |
1 files changed, 37 insertions, 0 deletions
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md new file mode 100644 index 0000000..99a1bf5 --- /dev/null +++ b/CONTRIBUTING.md @@ -0,0 +1,37 @@ +<!-- + Author: cirakg & claude ai + Summary: Development checks, safe test data and contribution licensing. +--> +# Contributing + +Bug reports and focused patches are welcome. Include the app version, watch model, reproduction steps, and expected and actual behavior. Use fabricated entries in examples, logs and screenshots. See [SECURITY.md](SECURITY.md) for vulnerability reports. + +## Development + +Follow the Docker setup in the [README](README.md) and the [developer guide](docs/DEVELOPER_GUIDE.md). Use `make test-tools` for Python tooling changes, `make test` for application tests, `make lint` for static checks, and `make docs` for documentation. UI changes should also pass `make screenshots`; review image differences before approving new golden images. Before a release, run `make ci ALL=1` for the full device matrix. Routine checks default to `fr70`. + +Describe what changed and how you verified it. Keep expensive work in resumable jobs and preserve the app's no-network-permissions design. The [project plan](docs/PROJECT_PLAN.md) preserves the original numbered design sections referenced in source comments and historical changelog entries. + +## Secrets and private data + +Never commit signing keys, Garmin credentials, SDK/device downloads, real OTP seeds, authenticator exports, watch storage dumps, or screenshots containing real accounts or barcodes. `.gitignore` covers common filenames, but cannot identify every private file. Keep personal test data outside this checkout. The checked-in fixtures use published RFC keys and fabricated accounts; they must never be used for real accounts. + +Install [Gitleaks](https://github.com/gitleaks/gitleaks) v8.25.0 or newer for secret scanning. Scan all reachable history before publishing: + +```sh +gitleaks git --log-opts=--all --redact --no-banner . +``` + +Optionally enable the staged-file check for each commit (requires Gitleaks on the host): + +```sh +git config core.hooksPath .githooks +``` + +The checked-in configuration extends Gitleaks' default detectors and allows only specific reviewed test values in specific fixture files. Review new findings; do not suppress a whole test folder. Git history also preserves deleted data and commit author emails. If a real credential is committed, revoke or rotate it before arranging history cleanup. + +## Licensing + +By submitting a contribution, you agree to license your original work under GPL-3.0-only, as described in [LICENSE](LICENSE). Preserve upstream notices when using third-party material and update [THIRD_PARTY_NOTICES.md](THIRD_PARTY_NOTICES.md). Garmin's SDK and device files have their own terms and must not be added to the repository. + +When distributing a binary, include the license and upstream notices copied into `build/package/` by `make package`, and provide the corresponding source, including build scripts and any modifications. A Store upload alone does not supply that source: publish the matching source version and make its location available to recipients. |