main is protected and all changes are merged through pull requests. A branch must be current with main, have a GitHub Review record, resolve all review conversations, and pass the required CI, browser smoke, CodeQL, and desktop checks before merging.
npm ci
npm run devBefore opening a pull request:
npm run check
npm run test:smoke
npm run desktop:check- Low risk: automated checks plus one review.
- Medium risk: one review and the affected smoke path.
- High risk: one security-aware review, affected integration tests, and a manual macOS check.
- High-risk areas include selection capture, Accessibility permissions, credentials, document parsing, packaging, and release workflows.
Tests should describe user-visible behavior. A fix must include a regression test when the failure can be reproduced automatically.
Use semantic versions. Beta tags such as v0.1.0-beta.1 create a draft prerelease; a maintainer reviews the artifacts and changelog before publishing.