Skip to content

Commit 6e25bc9

Browse files
Aqib-RimeAqib-Rime
committed
docs: add CONTRIBUTING, SECURITY, and issue/PR templates
Establish contributor workflow and responsible-disclosure policy, and replace blank issues with structured bug-report and feature-request forms.
1 parent cf47276 commit 6e25bc9

6 files changed

Lines changed: 310 additions & 0 deletions

File tree

‎.github/ISSUE_TEMPLATE/bug_report.yml‎

Lines changed: 79 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
name: Bug report
2+
description: Report a bug in the mobile app, admin, or backend
3+
title: "bug: "
4+
labels: ["bug", "triage"]
5+
body:
6+
- type: markdown
7+
attributes:
8+
value: |
9+
Thanks for taking the time to file a bug report. Please fill in as much detail as you can — it helps us ship a fix faster.
10+
11+
- type: dropdown
12+
id: surface
13+
attributes:
14+
label: Where did the bug happen?
15+
options:
16+
- Mobile app (iOS)
17+
- Mobile app (Android)
18+
- Admin panel (web)
19+
- Backend / API
20+
- Build / deploy / monorepo tooling
21+
- Not sure
22+
validations:
23+
required: true
24+
25+
- type: textarea
26+
id: what-happened
27+
attributes:
28+
label: What happened?
29+
description: A clear description of what went wrong and what you expected instead.
30+
placeholder: "When I tap the qibla compass, the dial freezes and stops responding to phone movement…"
31+
validations:
32+
required: true
33+
34+
- type: textarea
35+
id: reproduce
36+
attributes:
37+
label: Steps to reproduce
38+
description: The minimal set of steps to trigger the bug.
39+
placeholder: |
40+
1. Open the app
41+
2. Go to Profile → Find Qibla
42+
3. Rotate the phone 180°
43+
4. Observe: dial does not rotate
44+
validations:
45+
required: true
46+
47+
- type: input
48+
id: platform-version
49+
attributes:
50+
label: Platform + OS version
51+
description: e.g. iOS 18.2 on iPhone 15 Pro, Android 14 on Pixel 8, Chrome 130 on macOS 15
52+
validations:
53+
required: true
54+
55+
- type: input
56+
id: app-version
57+
attributes:
58+
label: App / commit version
59+
description: Git SHA or EAS build number (check Settings → About in the app)
60+
validations:
61+
required: false
62+
63+
- type: textarea
64+
id: logs
65+
attributes:
66+
label: Logs, screenshots, or screen recordings
67+
description: Drop them here. Metro / Wrangler / console output is especially helpful for crashes.
68+
validations:
69+
required: false
70+
71+
- type: checkboxes
72+
id: prechecks
73+
attributes:
74+
label: Pre-submission checklist
75+
options:
76+
- label: I searched existing issues and this one isn't already reported
77+
required: true
78+
- label: I am running the latest `main` (or have noted the exact commit above)
79+
required: true

‎.github/ISSUE_TEMPLATE/config.yml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
blank_issues_enabled: false
2+
contact_links:
3+
- name: Security vulnerability
4+
url: https://github.com/Aqib-Rime/qibla/security/advisories/new
5+
about: Please do not open public issues for security vulnerabilities. Use private reporting instead.
6+
- name: Question or discussion
7+
url: https://github.com/Aqib-Rime/qibla/discussions
8+
about: For general questions, ideas, or anything that isn't a clear bug or feature request.

‎.github/ISSUE_TEMPLATE/feature_request.yml‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
name: Feature request
2+
description: Suggest a new feature or an improvement to an existing one
3+
title: "feat: "
4+
labels: ["enhancement", "triage"]
5+
body:
6+
- type: markdown
7+
attributes:
8+
value: |
9+
Before filing, please check the [V2 scope](https://github.com/Aqib-Rime/qibla) to see if the idea is already planned. For anything larger than a small tweak, please describe the use case first — implementation details can come later.
10+
11+
- type: textarea
12+
id: problem
13+
attributes:
14+
label: What problem does this solve?
15+
description: The user-facing problem or friction point. Skip the solution for now — focus on the "why".
16+
placeholder: "When I travel between neighborhoods I want to compare mosques by distance, but the list is only sortable by name…"
17+
validations:
18+
required: true
19+
20+
- type: textarea
21+
id: proposal
22+
attributes:
23+
label: Proposed solution
24+
description: How you think it could work. Mockups, code sketches, or links to similar features in other apps are all welcome.
25+
validations:
26+
required: false
27+
28+
- type: dropdown
29+
id: surface
30+
attributes:
31+
label: Which surface?
32+
options:
33+
- Mobile app (iOS + Android)
34+
- Admin panel
35+
- Backend / API
36+
- Monorepo tooling / build
37+
- Cross-cutting
38+
validations:
39+
required: true
40+
41+
- type: textarea
42+
id: alternatives
43+
attributes:
44+
label: Alternatives considered
45+
description: Other approaches you thought about and why you set them aside.
46+
validations:
47+
required: false
48+
49+
- type: checkboxes
50+
id: prechecks
51+
attributes:
52+
label: Pre-submission checklist
53+
options:
54+
- label: I searched existing issues and this isn't already requested
55+
required: true

‎.github/PULL_REQUEST_TEMPLATE.md‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
<!--
2+
Thanks for opening a PR! Keep the title in Conventional Commits format:
3+
feat(mobile/qibla): add calibration overlay
4+
fix(admin/reviews): recompute rating on status change
5+
docs: expand EAS build instructions
6+
-->
7+
8+
## Summary
9+
10+
<!-- One or two sentences on what this PR does and why. Link issues with "Closes #123" if relevant. -->
11+
12+
## Type of change
13+
14+
- [ ] Bug fix
15+
- [ ] New feature
16+
- [ ] Refactor (no behavior change)
17+
- [ ] Documentation / README
18+
- [ ] Build, CI, or tooling
19+
- [ ] Breaking change
20+
21+
## Testing
22+
23+
<!-- How did you verify this works? Device + OS for mobile changes, browser for admin. -->
24+
25+
- [ ] `bun run typecheck` passes
26+
- [ ] `bun run lint` passes
27+
- [ ] Tested locally (describe the flow below)
28+
29+
<!-- Paste screenshots, GIFs, or log output here when useful. -->
30+
31+
## Checklist
32+
33+
- [ ] Title follows Conventional Commits (`feat(scope): ...`)
34+
- [ ] No secrets committed (`.env.local`, `.dev.vars`)
35+
- [ ] Docs / README updated if the user-facing behavior changed
36+
- [ ] Mobile UI tested in a dev build on a real device (if touching native APIs)
37+
- [ ] Admin changes tested against a real Neon database

‎CONTRIBUTING.md‎

Lines changed: 82 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
# Contributing to Qibla
2+
3+
Thanks for your interest in Qibla. Contributions, bug reports, and feature ideas are all welcome.
4+
5+
## Before you start
6+
7+
For anything non-trivial, **please open an issue first** so we can align on scope and direction before you spend time writing code. Small fixes (typos, obvious bugs, docs improvements) can go straight to a PR.
8+
9+
## Development setup
10+
11+
The full getting-started guide lives in the [README](./README.md#getting-started). Quick version:
12+
13+
```bash
14+
git clone https://github.com/Aqib-Rime/qibla.git
15+
cd qibla
16+
bun install
17+
cp .env.example .env.local # fill in Neon URL + auth secret
18+
bun db:push
19+
bun db:seed
20+
bun run dev:admin # terminal 1
21+
cd apps/mobile && bun start # terminal 2
22+
```
23+
24+
## Workflow
25+
26+
1. Fork the repo and create a topic branch from `main` — prefer a short, descriptive name: `feat/events-admin`, `fix/qibla-heading-drift`, `docs/env-vars`
27+
2. Make your change
28+
3. Keep these commands green before opening the PR:
29+
```bash
30+
bun run typecheck
31+
bun run lint
32+
```
33+
4. Open a PR against `main`
34+
35+
## Commit messages
36+
37+
Follow the existing convention — [Conventional Commits](https://www.conventionalcommits.org/) with a feature scope:
38+
39+
```
40+
feat(mobile/qibla): add calibration overlay
41+
fix(admin/reviews): recompute rating on status change
42+
docs: add EAS build notes
43+
chore: bump expo to 54.0.34
44+
```
45+
46+
Do **not** amend, squash, or rewrite commits already pushed to `main`.
47+
48+
## PR checklist
49+
50+
- [ ] The PR title follows the Conventional Commits format
51+
- [ ] `bun run typecheck` passes
52+
- [ ] `bun run lint` passes
53+
- [ ] The change is covered by the existing README / docs (or docs updated)
54+
- [ ] For mobile UI changes: tested in a dev build on a real device (not just Expo Go)
55+
- [ ] For admin changes: tested against a real Neon database, not a mocked one
56+
- [ ] No secrets committed (check `.env.local`, `.dev.vars`)
57+
58+
## Coding guidelines
59+
60+
- **TypeScript everywhere** — no `any` unless there's a comment explaining why
61+
- **Feature-module architecture** — new mobile features live in `apps/mobile/features/<name>/` with `components/`, `hooks/`, `lib/`, and a barrel `index.ts`. See existing features for the pattern
62+
- **Route files are thin** — they should re-export from a feature module, not contain logic
63+
- **Styling** — NativeWind on mobile, Tailwind v4 + shadcn primitives on admin. No ad-hoc StyleSheet or CSS-in-JS
64+
- **API** — add new endpoints to `packages/api`. Use `publicProcedure` / `authedProcedure` / `adminProcedure` depending on access level
65+
- **DB** — all schema changes go through Drizzle. Run `bun db:generate` to create a migration, commit the generated SQL
66+
67+
## Reporting bugs
68+
69+
Open a [bug report](https://github.com/Aqib-Rime/qibla/issues/new/choose) with:
70+
71+
- Platform + OS version (iOS 18 on iPhone 15, Android 14 on Pixel 8, etc.)
72+
- Steps to reproduce
73+
- Expected vs actual behavior
74+
- Logs / screenshots if you have them
75+
76+
## Security issues
77+
78+
Please do **not** open a public issue for security vulnerabilities. See [SECURITY.md](./SECURITY.md) for responsible disclosure.
79+
80+
## License
81+
82+
By contributing, you agree that your contributions will be licensed under the [MIT License](./LICENSE).

‎SECURITY.md‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
# Security Policy
2+
3+
## Reporting a vulnerability
4+
5+
If you discover a security vulnerability in Qibla, **please do not open a public GitHub issue.** Public issues are visible to everyone and can put users at risk before a fix ships.
6+
7+
Instead, report it privately using one of these channels:
8+
9+
- **GitHub Private Vulnerability Reporting** — open [Report a vulnerability](https://github.com/Aqib-Rime/qibla/security/advisories/new) on the Security tab of the repo (preferred)
10+
- **Email** — send details to the maintainer directly via the email listed on [@Aqib-Rime's GitHub profile](https://github.com/Aqib-Rime)
11+
12+
Please include:
13+
14+
- A description of the vulnerability
15+
- Steps to reproduce
16+
- The affected component (mobile app / admin / API / auth / DB)
17+
- Your assessment of the impact
18+
- Any suggested mitigations, if you have them
19+
20+
## What to expect
21+
22+
- **Acknowledgement** within 72 hours
23+
- **Initial assessment** within 7 days
24+
- **Fix or mitigation plan** communicated before any public disclosure
25+
- **Credit** in the release notes once the fix ships, if you want it
26+
27+
## Supported versions
28+
29+
This project is pre-1.0 and under active development. Only the `main` branch is supported. Please run the latest commit when reporting issues.
30+
31+
## Scope
32+
33+
In-scope:
34+
35+
- The mobile app (`apps/mobile`)
36+
- The admin / API (`apps/admin`)
37+
- All shared packages (`packages/*`)
38+
- The deployment configuration (Cloudflare Workers, EAS)
39+
40+
Out of scope (report to the upstream project instead):
41+
42+
- Vulnerabilities in Expo, TanStack Start, Drizzle, Better Auth, oRPC, or other dependencies
43+
- Issues in third-party services (Neon, Cloudflare, AlAdhan API, Google Maps)
44+
45+
## Responsible disclosure
46+
47+
We ask that you give us a reasonable window — typically 90 days — to ship a fix before any public disclosure. If the vulnerability is being actively exploited, we will work with you on an accelerated timeline.
48+
49+
Thank you for helping keep Qibla and its users safe.

0 commit comments

Comments
 (0)