Thanks for your interest in contributing! This file covers contribution mechanics; see README.md for project setup and local development.
- Join our Discord guild — development discussion happens there.
- Follow the Development - Getting Started section in README.md to get a local instance running.
mainis the production branch.uatis the staging/integration branch.- Feature branches are created from
uatand opened as pull requests intouat, notmain. A GitHub Action (GuardMainSource) enforces that onlyuatmay open a pull request intomain. - Before opening a pull request, pull the latest
uatinto your feature branch first so it's up to date and the push won't be rejected as non-fast-forward. Prefer branching fresh fromuatover rebasing an existing shared/pushed branch, since rewriting history on a branch others may have pulled is riskier. - Keep commits focused and use the repository's concise, imperative commit message style (see
git logfor examples). - Do not force-push shared branches or use destructive Git commands to "clean up" a branch.
Every pull request into main or uat runs lint, a production build (which includes a full TypeScript check),
and CodeQL. Run the equivalent checks locally first:
# Install dependencies (matches CI)
npm ci
# Lint
npx eslint .
# Production build (also type-checks)
npx next buildCommitting runs lint-staged automatically via Husky, which lints and fixes your staged files.
- Keep pull requests scoped to the problem they solve — avoid unrelated refactors, formatting, or drive-by renames.
- Treat changes to drug information, dosage text, crisis resources, and privacy/legal pages as high-impact: preserve established wording and data sources.
- Never commit
.env, tokens, passwords, or private URLs.