# Contributing Bug reports and focused patches are welcome. Include the app version, watch model, reproduction steps, and expected and actual behavior. Use fabricated entries in examples, logs and screenshots. See [SECURITY.md](SECURITY.md) for vulnerability reports. ## Development Follow the Docker setup in the [README](README.md) and the [developer guide](docs/DEVELOPER_GUIDE.md). Use `make test-tools` for Python tooling changes, `make test` for application tests, `make lint` for static checks, and `make docs` for documentation. UI changes should also pass `make screenshots`; review image differences before approving new golden images. Before a release, run `make ci ALL=1` for the full device matrix. Routine checks default to `fr70`. Describe what changed and how you verified it. Keep expensive work in resumable jobs and preserve the app's no-network-permissions design. The [project plan](docs/PROJECT_PLAN.md) preserves the original numbered design sections referenced in source comments and historical changelog entries. ## Secrets and private data Never commit signing keys, Garmin credentials, SDK/device downloads, real OTP seeds, authenticator exports, watch storage dumps, or screenshots containing real accounts or barcodes. `.gitignore` covers common filenames, but cannot identify every private file. Keep personal test data outside this checkout. The checked-in fixtures use published RFC keys and fabricated accounts; they must never be used for real accounts. Install [Gitleaks](https://github.com/gitleaks/gitleaks) v8.25.0 or newer for secret scanning. Scan all reachable history before publishing: ```sh gitleaks git --log-opts=--all --redact --no-banner . ``` Optionally enable the staged-file check for each commit (requires Gitleaks on the host): ```sh git config core.hooksPath .githooks ``` The checked-in configuration extends Gitleaks' default detectors and allows only specific reviewed test values in specific fixture files. Review new findings; do not suppress a whole test folder. Git history also preserves deleted data and commit author emails. If a real credential is committed, revoke or rotate it before arranging history cleanup. ## Licensing By submitting a contribution, you agree to license your original work under GPL-3.0-only, as described in [LICENSE](LICENSE). Preserve upstream notices when using third-party material and update [THIRD_PARTY_NOTICES.md](THIRD_PARTY_NOTICES.md). Garmin's SDK and device files have their own terms and must not be added to the repository. When distributing a binary, include the license and upstream notices copied into `build/package/` by `make package`, and provide the corresponding source, including build scripts and any modifications. A Store upload alone does not supply that source: publish the matching source version and make its location available to recipients.