From 6fd69a2cd846d583f53b18c69d3917a468964dc2 Mon Sep 17 00:00:00 2001
From: Jens Caers <jens@itworx.tech>
Date: Mon, 31 Aug 2026 01:40:57 +0200
Subject: [PATCH] Add contribution and release hygiene guidance

---
 CONTRIBUTING.md | 13 +++++++++++++
 1 file changed, 13 insertions(+)
 create mode 100644 CONTRIBUTING.md

diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
new file mode 100644
index 0000000..98b5667
--- /dev/null
+++ b/CONTRIBUTING.md
@@ -0,0 +1,13 @@
+# Contributing
+
+ForgeFlow changes must preserve exact-commit provenance, update integrity and safe deployment boundaries.
+
+Before opening a pull request:
+
+- do not commit tokens, SSH credentials, signing private keys, deployment secrets or local repository state;
+- keep update manifests/checksums/signatures deterministic and reviewable;
+- add regression tests for repository synchronization, dirty-file handling, update and deployment changes;
+- keep real deployment targets configurable rather than embedding private infrastructure;
+- run `npm run quality` and the managed validation workflow where supported.
+
+Release metadata should distinguish an unreleased package version from the latest published Gitea Release; do not advance public release claims until the corresponding release exists.