Skip to content

CONTRIBUTING.md

Latest commit

 

History

History
52 lines (37 loc) · 2.26 KB

CONTRIBUTING.md

File metadata and controls

52 lines (37 loc) · 2.26 KB
Raw

Contributing

Thanks for your interest in improving the tempus.build runner images.

License of contributions and sign-off (DCO)

Contributions are accepted under the repository license, Apache-2.0. By submitting a PR you certify the Developer Certificate of Origin; sign off each commit (git commit -s, adds a Signed-off-by: trailer). No CLA is required.

Development setup

Requires Docker, just, and pre-commit. After cloning:

just hooks    # install the pre-commit git hook

Checks (run before opening a PR)

just ci       # everything CI runs: lint + build/test/scan of both images

Or piecewise: just lint, just test / just scan (full image, builds it first), just test-minimal / just scan-minimal (minimal image); just --list shows all recipes. The same set runs in CI — PRs must be green on the test workflow.

Conventions

  • Pin everything. Base image by sha256: digest, every tool/toolchain by exact version, GitHub Actions by commit SHA. Never :latest or floating tags. Downloaded artifacts are verified by SHA256/512, or installed from key-verified vendor apt repositories.
  • Security baseline. Run as the unprivileged runner user; no secrets in layers, ENV, or ARG; clean the apt cache in the same RUN; avoid unnecessary surface (no stray setuid).
  • CVEs. The build fails on fixable HIGH/CRITICAL. Prefer fixing over suppressing; documented exceptions go in .trivyignore.yaml with a statement and expired_at.
  • Comments are English, written only where they add non-obvious context — no decorative banners, no restating the obvious.
  • Shell scripts start with set -euo pipefail.

Versions

Before bumping a version, check the upstream release/manifest. Renovate proposes version bumps (see renovate.json) but does not recompute the paired *_SHA256/*_SHA512 — recompute and update the hash in the same PR. Toolcache versions come from their upstream manifests (go.dev/dl, actions/python-versions, actions/node-versions, ruby/ruby-builder, …).

Reporting security issues

Do not open a public issue for a vulnerability — see SECURITY.md.