From 2bd73707cb99c2afb8a6e4969fe2edd01eafd3dd Mon Sep 17 00:00:00 2001 From: badhope Date: Wed, 10 Jun 2026 19:24:50 +0800 Subject: [PATCH 1/6] docs: add/update .github/PULL_REQUEST_TEMPLATE.md --- .github/PULL_REQUEST_TEMPLATE.md | 35 ++++++++++++++++++++------------ 1 file changed, 22 insertions(+), 13 deletions(-) diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md index 3834887..673eccd 100644 --- a/.github/PULL_REQUEST_TEMPLATE.md +++ b/.github/PULL_REQUEST_TEMPLATE.md @@ -1,27 +1,36 @@ ## What - + ## Why - + ## How - + -## Tested +## Test plan - + -## Checklist +- [ ] Existing tests pass +- [ ] Added tests for new behaviour +- [ ] Manually verified in dev / staging + +## Risk & rollout -- [ ] I have read [`CONTRIBUTING.md`](./CONTRIBUTING.md) -- [ ] Tests pass locally (and CI is green) -- [ ] I didn't add any new linter / typecheck warnings -- [ ] I didn't commit any secrets, build output, or large binaries -- [ ] I added a `CHANGELOG.md` entry under "Unreleased" if it matters + + +## Checklist -## Screenshots / Logs +- [ ] My branch is up-to-date with the base branch +- [ ] I ran `gitleaks` locally (or let CI do it) +- [ ] I added / updated tests for new behaviour +- [ ] I updated documentation (README, CHANGELOG, …) +- [ ] I did **not** commit any secrets, tokens, or credentials +- [ ] My commit messages follow [Conventional Commits](https://www.conventionalcommits.org/) - +> **Never commit secrets.** If you accidentally committed a token, +> rotate it **immediately** in the provider's settings, then update +> the PR to remove the secret. See [SECURITY.md](./SECURITY.md). From df80b9ff4716128f0e80527e12c3b25c1c2dc9a9 Mon Sep 17 00:00:00 2001 From: badhope Date: Wed, 10 Jun 2026 19:24:52 +0800 Subject: [PATCH 2/6] docs: add/update .github/ISSUE_TEMPLATE/bug_report.md --- .github/ISSUE_TEMPLATE/bug_report.md | 40 +++++++++++++++------------- 1 file changed, 21 insertions(+), 19 deletions(-) diff --git a/.github/ISSUE_TEMPLATE/bug_report.md b/.github/ISSUE_TEMPLATE/bug_report.md index 1271c2d..5564df2 100644 --- a/.github/ISSUE_TEMPLATE/bug_report.md +++ b/.github/ISSUE_TEMPLATE/bug_report.md @@ -1,38 +1,40 @@ --- name: Bug report -about: Something on the deployed site or in the data is broken +about: Something is broken title: "[bug] " -labels: ["bug", "needs-triage"] -assignees: [] +labels: bug +assignees: badhope --- -## What happened +## Describe the bug -A clear, one-sentence description of the bug. + -## Steps to reproduce +## To reproduce -1. Go to '…' -2. Click on '…' -3. See '…' +```bash +# Minimal reproduction steps +``` ## Expected behaviour -What you expected to happen. + ## Actual behaviour -What actually happened. Include screenshots / copy-pasted error text / -relevant snippets from the browser dev-tools console or Network tab. + ## Environment -- Page URL (e.g. `https://badhope.github.io/API-Market/stats/`) -- Browser + version -- Device (desktop / mobile, OS) -- Does the issue reproduce in a private / incognito window? +- OS: +- Runtime version: +- Package version: +- Date observed: -## Possible cause +## Severity -Optional — if you've already traced the problem to a file, route, or -query parameter, mention it here. +- [ ] Blocker — production is down +- [ ] High — feature unusable +- [ ] Medium — workaround exists +- [ ] Low — cosmetic From 1f79f3a30063e2ea46c1d954b7c77da280b5a6ed Mon Sep 17 00:00:00 2001 From: badhope Date: Wed, 10 Jun 2026 19:24:54 +0800 Subject: [PATCH 3/6] docs: add/update .github/ISSUE_TEMPLATE/feature_request.md --- .github/ISSUE_TEMPLATE/feature_request.md | 34 ++++++++--------------- 1 file changed, 12 insertions(+), 22 deletions(-) diff --git a/.github/ISSUE_TEMPLATE/feature_request.md b/.github/ISSUE_TEMPLATE/feature_request.md index c6428c3..81ecb8d 100644 --- a/.github/ISSUE_TEMPLATE/feature_request.md +++ b/.github/ISSUE_TEMPLATE/feature_request.md @@ -1,35 +1,25 @@ --- name: Feature request -about: Suggest an improvement to the platform, the site, or the data -title: "[feature] " -labels: ["enhancement", "needs-triage"] -assignees: [] +about: Suggest an idea +title: "[feat] " +labels: enhancement +assignees: badhope --- -## Summary +## Problem -One-paragraph description of the feature. - -## Motivation - -What problem does this solve? Who is it for? Is there a workaround -today? + ## Proposed solution -How would you like this to work? Mockups / ASCII sketches / example -URLs are very welcome. + ## Alternatives considered -Other approaches you've thought about, and why you prefer the one -above. + -## Scope +## Willingness to contribute -- [ ] Frontend only (`frontend/src/`) -- [ ] Backend only (`backend/api_market/`) -- [ ] Data pipeline (`pipeline/collector.py` / `scripts/`) -- [ ] Static export / GitHub Pages deployment -- [ ] Documentation / translations -- [ ] Not sure — happy to discuss +- [ ] I would submit a PR for this +- [ ] I would test a PR for this +- [ ] I would only discuss / design From 22a780d47a991530cd60a12246b4fdbde61267ae Mon Sep 17 00:00:00 2001 From: badhope Date: Wed, 10 Jun 2026 19:24:55 +0800 Subject: [PATCH 4/6] docs: add/update .github/ISSUE_TEMPLATE/security_report.md --- .github/ISSUE_TEMPLATE/security_report.md | 39 +++++++++++++++++++++++ 1 file changed, 39 insertions(+) create mode 100644 .github/ISSUE_TEMPLATE/security_report.md diff --git a/.github/ISSUE_TEMPLATE/security_report.md b/.github/ISSUE_TEMPLATE/security_report.md new file mode 100644 index 0000000..8d710e5 --- /dev/null +++ b/.github/ISSUE_TEMPLATE/security_report.md @@ -0,0 +1,39 @@ +--- +name: Security report +about: Report a vulnerability (PRIVATE) +title: "[security] " +labels: security +assignees: badhope +--- + +> **Please do not disclose the vulnerability in a public issue.** +> Use this private channel and the repository owner will respond within +> 7 days. If you cannot wait, email the security contact listed in +> [SECURITY.md](./SECURITY.md). + +## Summary + + + +## Affected component(s) + +- File(s): +- Function(s) / endpoint(s): +- Version / commit SHA: + +## Severity (your estimate) + +- [ ] Critical +- [ ] High +- [ ] Medium +- [ ] Low + +## Reproduction + +```bash +# Minimal steps / payload +``` + +## Impact + + From e21f6853ea9882bb9749fde7254681f52bfd6428 Mon Sep 17 00:00:00 2001 From: badhope Date: Wed, 10 Jun 2026 19:24:57 +0800 Subject: [PATCH 5/6] docs: add/update .github/CODEOWNERS --- .github/CODEOWNERS | 28 +++++++++++++++++++--------- 1 file changed, 19 insertions(+), 9 deletions(-) diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS index bbbc974..efc8651 100644 --- a/.github/CODEOWNERS +++ b/.github/CODEOWNERS @@ -1,12 +1,22 @@ -# Code owners: auto-assign reviewers for pull requests. -# https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners +# CODEOWNERS — default review ownership +# badhope is the sole owner; replace with team handles in a +# multi-maintainer setup. -# Default owner for everything in the repo. +# Default: everything * @badhope -# Security-sensitive files get an explicit owner reminder. -/SECURITY.md @badhope -/.github/workflows/ @badhope -/.gitleaks.toml @badhope -/.github/dependabot.yml @badhope -/CODEOWNERS @badhope +# GitHub configuration +/.github/ @badhope + +# Documentation +/docs/ @badhope +/README.md @badhope +/CHANGELOG.md @badhope + +# Build / release config +/package.json @badhope +/uv.lock @badhope +/package-lock.json @badhope +/pnpm-lock.yaml @badhope +/Cargo.toml @badhope +/Cargo.lock @badhope From 8f67e6e56ec71e4ea22a1fe8d8a4b102a5a6a50f Mon Sep 17 00:00:00 2001 From: badhope Date: Wed, 10 Jun 2026 19:24:59 +0800 Subject: [PATCH 6/6] docs: add/update .github/CONTRIBUTING.md --- .github/CONTRIBUTING.md | 63 +++++++++++++++++++++++++++++++++++++++++ 1 file changed, 63 insertions(+) create mode 100644 .github/CONTRIBUTING.md diff --git a/.github/CONTRIBUTING.md b/.github/CONTRIBUTING.md new file mode 100644 index 0000000..ea5ff0c --- /dev/null +++ b/.github/CONTRIBUTING.md @@ -0,0 +1,63 @@ +# Contributing + +Thanks for your interest in contributing! This document covers the +ground rules so your PR can land quickly and cleanly. + +## Branch & PR workflow + +> **Direct pushes to `main` are blocked by branch protection.** + +1. **Fork** (or create a feature branch if you have write access). +2. **Branch off `main`**: `git switch -c feat/short-description` +3. **Make focused commits** following + [Conventional Commits](https://www.conventionalcommits.org/): + - `feat: …` — new feature + - `fix: …` — bug fix + - `refactor: …` — no behaviour change + - `docs: …` — documentation only + - `chore(deps): …` — dependency bumps + - `security: …` — security fix +4. **Push your branch**: `git push -u origin feat/short-description` +5. **Open a Pull Request** against `main`. Fill in the PR template. +6. **Wait for CI** (gitleaks + CodeQL on every repo that has code). +7. **Squash-merge** is the default. One commit per logical change. + The merge commit subject will become the PR title. + +## Code style + +- Match the existing style of the file you are editing. +- Keep diffs minimal — don't reformat unrelated code. +- Add tests for new behaviour. Bug fixes should add a regression test + that fails on `main` and passes on your branch. +- No dead code, no commented-out code, no orphan TODO comments. + +## Security + +- **Never commit secrets, tokens, API keys, or `.env` files.** + Push-protection is on; if you bypass it, **rotate the credential**. + See [SECURITY.md](./SECURITY.md). +- Don't paste stack traces that contain real user data in issues. +- If you find a vulnerability, follow the + [private disclosure process](./SECURITY.md) — do not open a public + issue. + +## Dependencies + +- Dependabot opens weekly PRs for all package ecosystems detected + in the repo (npm, pip, cargo, docker, github-actions, gitsubmodule, + composer, gomod, bundler, nuget, maven, gradle). +- Dependabot PRs are auto-mergeable when CI passes — they do not need + a review from a human (the branch is signed and the diff is small). +- Major-version bumps that touch lockfiles will be reviewed manually. + +## Issue triage + +- New issues are auto-labelled **bug** / **enhancement** / **security** + via the issue templates. +- Please use the right template. Issues without a template take longer + to triage. + +## License + +By submitting a contribution, you agree that your work will be +licensed under the same license as the repository.