ITWorx Pulse release export
bd774932d5
Public source validation / validate (push) Failing after 3m8s
23 lines
1.3 KiB
Markdown
23 lines
1.3 KiB
Markdown
# Contributing
|
|
|
|
Contributions must preserve Pulse's read-only observability and evidence boundaries.
|
|
|
|
Start with a focused issue or proposal for material behavior changes. Keep pull requests small enough to review, explain the user-visible outcome, and include tests for the changed boundary.
|
|
|
|
- use synthetic telemetry and isolated test databases;
|
|
- never commit production dashboards, host inventories, credentials, backups or alert payloads;
|
|
- keep application changes separate from agent/planning/evidence updates;
|
|
- document new data collection, retention, authorization and network behaviour;
|
|
- run the repository's managed validation and the relevant Go, frontend, integration and Compose checks;
|
|
- retain provenance for screenshots and evidence summaries, and keep generated heavy artifacts outside Git.
|
|
|
|
Changes that alter the read-only promise, OIDC/RBAC policy, backup format, agent privileges or deployment topology require explicit security review. Report sensitive findings through `SECURITY.md`.
|
|
|
|
For a public source checkout, run:
|
|
|
|
```powershell
|
|
pwsh -NoProfile -File scripts/public-verify.ps1
|
|
```
|
|
|
|
Go code must be formatted with `gofmt`; frontend changes must pass tests, typecheck, lint, and build. Do not weaken a failing gate or replace a real integration boundary with a mock merely to obtain a green result.
|