Skip to content

CONTRIBUTING.md

Latest commit

 

History

History
54 lines (38 loc) · 5.71 KB

CONTRIBUTING.md

File metadata and controls

54 lines (38 loc) · 5.71 KB
Raw

Contributing

Thanks for wanting to contribute. One rule up front:

All pull requests to this repository must be raised through no-slop.

This repo is no-slop. Contributions should be done using the tool itself, which reduces the maintainer's burden of reviewing and merging contributions. For every relevant non-automation PR event, the Require no-slop GitHub Actions workflow fails unless the body begins with a valid publication identity and contains exactly one owned ## Pipeline tuple: a recognized no-slop signature immediately followed by a parseable v1 pipeline attestation carrying the same publication nonce. The attestation must be bound to the current PR head and record review, test, and document exactly once as completed and individually certified against that head; skipped, failed, pending, running, stale, duplicated, or missing required steps are not merge authority. Current no-slop and no-mistakes compatibility signatures are recognized. The historical Updates from [git push no-mistakes](https://github.com/kunchenguid/no-mistakes) signature is accepted only inside that fully valid current tuple; the historical signature by itself grants no authority. During the publication-nonce rollout, an opened or synchronize event may instead carry the canonical pre-nonce v1 tuple emitted by an installed older no-slop binary. That narrow bootstrap requires completed review, test, and document statuses. An opened event must still attest its current head; a synchronize event may carry the pre-repair head because an older daemon cannot republish after committing its CI repair. Body edits and historical signatures do not qualify, and every nonce-bearing publication remains bound to the current head.

Every checked opened or edited event gets an independent run, including first-time-fork runs that become actionable through GitHub's normal approval process. The integration contract for consumers such as Wheelhouse is:

  • The stable check name is PR must be raised via no-slop.
  • The workflow run's display_title starts with no-slop-required|<action>|PR #<number> event <run_number> (run <run_id>)|, followed by the event body. A generated body begins with the publication identity, allowing no-slop to bind that publication to immutable Actions metadata without trusting job output. For a PR, increasing run_number orders distinct events; a re-run retains that event identity and increments run_attempt.
  • The run's head_sha binds the evidence to the reviewed commit. After the latest opened or edited run reaches status: completed, conclusion: success means that event's body contained the signature and a current v1 attestation with review, test, and document each completed against that same head. conclusion: failure, action_required, or cancelled is not compliance evidence and must be handled conservatively.
  • Fork runs stay on the pull_request boundary with read-only contents permission, no repository secrets, and no checkout or execution of fork code. Approval permits only this body check; it does not grant write authority.

Workflow

  1. Fork the repo, then clone the parent repo or set your local origin back to the parent repo (git@github.com:Blakeolson21/no-slop.git).

  2. Create a branch and make your changes.

  3. Initialize or refresh the gate with your fork as the push target: no-slop init --fork-url git@github.com:<you>/no-slop.git.

  4. Commit your changes.

  5. Push through the gate instead of pushing to origin:

    git push no-slop

  6. Run no-slop to attach to the pipeline, watch findings, and auto-fix or review as needed.

  7. Once the pipeline passes, it pushes the branch to your fork and opens the PR against the parent repo for you.

See the quick start for the full first-run walkthrough.

Repo conventions

  • Go 1.25+, standard toolchain. See AGENTS.md for agent instructions.
  • Run make fmt, make lint, and make test before pushing. Run make e2e too when you touch agent integrations, the e2e harness, or recorded fixtures. The pipeline will run them again, but a fast local pass saves rounds.
  • Run make skill when you change the canonical agent skill content under internal/skill; make lint fails if any committed no-slop skill file has drifted.
  • Use make e2e-record only when an upstream agent wire format changes or you are adding a new fixture flavor. It overwrites internal/e2e/fixtures/, spends real API quota, and the diff should be reviewed before committing.
  • Keep README.md high-level. Deep reference material belongs in docs/.
  • Do not hand-edit CHANGELOG.md or .release-please-manifest.json. They are regenerated by release-please from your conventional commit messages, and a separate Generated files must not be hand-edited check will fail the PR if either is touched.

Development-only test-quality check - 2026-07-30

  • Agent/model: codex-cli 0.145.0 using its configured default model. The JSON event stream did not report a model identifier, so none is claimed.
  • Command: codex exec --ephemeral --ignore-rules --sandbox read-only --json --color never -C <temporary-synthetic-repo> - against a temporary synthetic Git repo with read-only access and no live project input.
  • Input: two tiny staged diffs - a Go test that reads app.go and checks for a function-signature token while Ready() returns false, and a Go test that parses policy.json into a typed struct and asserts enabled enforcement semantics.
  • Outcome: it flagged the source-token test and accepted the typed JSON semantic test. This is qualitative policy evidence only, not a live-LLM CI gate.

Questions

Open an issue, or talk to me on Discord.