14 lines
798 B
Markdown
14 lines
798 B
Markdown
# Contributing
|
|
|
|
ForgeFlow changes must preserve exact-commit provenance, update integrity and safe deployment boundaries.
|
|
|
|
Before opening a pull request:
|
|
|
|
- do not commit tokens, SSH credentials, signing private keys, deployment secrets or local repository state;
|
|
- keep update manifests/checksums/signatures deterministic and reviewable;
|
|
- add regression tests for repository synchronization, dirty-file handling, update and deployment changes;
|
|
- keep real deployment targets configurable rather than embedding private infrastructure;
|
|
- run `npm run quality` and the managed validation workflow where supported.
|
|
|
|
Release metadata should distinguish an unreleased package version from the latest published Gitea Release; do not advance public release claims until the corresponding release exists.
|