Files

T

BrunoGaoandBrunoGaoSZ e29e2eed81 feat(governance): finalize lifecycle controls and compliance baseline (#22 )

* fix(ci): sanitize branch docker tags for ghcr builds

* feat(governance): finalize lifecycle controls and compliance baseline

* fix(governance): unblock p0 policy and gate checks

* fix(governance): add drift soft-fail and compile compatibility layer

* fix(app): scan legacy mapper package for mybatis

* fix(coverage): add jacoco and bootstrap soft-fail gate

* fix(gate): stabilize spec-quality and analysis lint checks

* fix(governance): restore legacy app imports for coverage build

* fix(ci): include master branch in ci triggers

* fix(ci): stabilize backend and frontend required checks

* fix(ci): allow frontend install without frozen lockfile

* fix(ci): soft-fail frontend lint in required check

---------

Co-authored-by: BrunoGaoSZ <[email protected]>

2026-03-03 22:40:05 +08:00

2.2 KiB

Raw Permalink Blame History

Contributing Guide

Scope

This repository is managed with GitHub Issues, Projects V2, Milestones, and Conventional Commits. All changes must be traceable from requirement to release. By submitting a contribution, you also agree to CLA.md.

Contribution Flow

Open or link an Issue before code changes.
Use a dedicated branch from main.
Keep commits in Conventional Commits format:
- feat(scope): ...
- fix(scope): ...
- refactor(scope): ...
- docs(scope): ...
- test(scope): ...
- chore(scope): ...
Open a Pull Request with:
- Issue linkage (Closes #... or Relates #...)
- phase/spec reference
- test evidence
Require CODEOWNERS review and passing status checks before merge.

Branching Strategy

Protected branches: main, master
Working branches: feature/*, fix/*, chore/*, hotfix/*
Merge mode: squash or rebase only (linear history)
Force push to protected branches is forbidden.

Definition Of Done

A PR is considered ready only when all items are satisfied:

linked Issue and scope are clear
CI and gate checks pass
docs/ADR updated when behavior or architecture changes
CHANGELOG.md updated for user-facing or operational changes
security impact is reviewed for auth/data/dependency changes

Code Review Policy

At least 1 approval is required.
CODEOWNERS paths require owner approval.
Reviewer must reject PRs lacking tests for behavior changes.
Unresolved conversations block merge.

Security And Secrets

Never commit credentials, tokens, or private keys.
Use repository or environment secrets in Actions.
Report vulnerabilities through SECURITY.md.

CLA

All contributors must accept CLA.md.
Maintainers may ask external contributors to include: I have read and agree to CLA.md in PR description.

Local Validation

Run before opening a PR:

bash scripts/ci/lint-shell.sh
bash scripts/ci/lint-yaml.sh
mvn -B -ntp -q test -f pom.xml

Project Management Metadata

Use labels and fields consistently:

labels: type:*, priority:*, phase-*, workflow:*
milestones: Phase XX
project fields: Phase, Workflow, Priority, Gate Status

2.2 KiB Raw Permalink Blame History