Thank you for your interest in contributing to DeployProof! DeployProof is an open-source, deterministic pre-push verification tool for Python (and multi-language roadmap) codebases.
- 100% Deterministic & Reproducible: Verification must never rely on non-deterministic LLM calls in the evaluation path. The same code input must yield the exact same mutation and security score across every run.
- Local-First & Zero Telemetry: DeployProof runs strictly on the developer's local machine and sends no telemetry, source code, test output, or findings to external servers. The only outbound network requests permitted are read-only HTTP GET queries to the official PyPI registry (to verify package existence) and the OSV database (for CVE advisories).
- No Breaking Performance Regressions: Diff-scoped mutation verification (
deployproof check) must execute in 2 to 5 seconds for typical 1–3 file changes.
-
Clone the repository:
git clone https://github.com/SVSPraveen/deployproof.git cd deployproof -
Create and activate a virtual environment:
python -m venv .venv # Windows (PowerShell): .venv\Scripts\Activate.ps1 # Linux/macOS: source .venv/bin/activate
-
Install dependencies and editable package:
pip install -e ".[dev]" -
Run the full test suite:
pytest
Before submitting a pull request, run DeployProof against itself:
# Verify modified working tree files
deployproof check
# Run with parallel workers
deployproof check --workers 4- Branching: Create a focused feature or bugfix branch (
feature/your-featureorfix/issue-description). - Tests Required: Every bug fix or new feature must include accompanying unit tests under
tests/. - Deterministic AST Rules: If adding new mutation operators or static control-flow rules, ensure AST transformation logic has corresponding test fixtures under
stress_fixtures/. - Clean Commits: Write clear, descriptive commit messages following the Conventional Commits specification.
Please maintain a welcoming, respectful, and constructive environment for all contributors.