Skip to content

Commit 6660656

Browse files
JCFcodexJCFcodex
committed
docs: adds code of conduct, contributing, and security guidelines
1 parent ffc9176 commit 6660656

3 files changed

Lines changed: 231 additions & 0 deletions

File tree

‎CODE_OF_CONDUCT.md‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
<div align="center">
2+
<img src="public/logo.png" alt="AinzStack Logo" width="64" />
3+
<br />
4+
<h1>Code of Conduct</h1>
5+
</div>
6+
7+
<p align="center">
8+
<strong>We are committed to providing a welcoming and inspiring community for all.</strong>
9+
</p>
10+
11+
---
12+
13+
## Our Pledge
14+
15+
In the interest of fostering an open, professional, and welcoming environment, we as contributors and maintainers pledge to making participation in our project and our community a harassment-free experience for everyone, regardless of age, body size, disability, ethnicity, sex characteristics, gender identity and expression, level of experience, education, socio-economic status, nationality, personal appearance, race, religion, or sexual identity and orientation.
16+
17+
## Our Standards
18+
19+
Examples of behavior that contributes to creating a positive environment include:
20+
21+
- Using welcoming and inclusive language.
22+
- Being respectful of differing viewpoints and experiences.
23+
- Gracefully accepting constructive criticism.
24+
- Focusing on what is best for the codebase and the community.
25+
- Showing empathy towards other community members.
26+
27+
Examples of unacceptable behavior by participants include:
28+
29+
- The use of sexualized language or imagery and unwelcome sexual attention or advances.
30+
- Trolling, insulting/derogatory comments, and personal or political attacks.
31+
- Public or private harassment.
32+
- Publishing others' private information, such as a physical or electronic address, without explicit permission.
33+
- Other conduct which could reasonably be considered inappropriate in a professional setting.
34+
35+
## Our Responsibilities
36+
37+
Project maintainers are responsible for clarifying the standards of acceptable behavior and are expected to take appropriate and fair corrective action in response to any instances of unacceptable behavior.
38+
39+
Project maintainers have the right and responsibility to remove, edit, or reject comments, commits, code, wiki edits, issues, and other contributions that are not aligned to this Code of Conduct, or to ban temporarily or permanently any contributor for other behaviors that they deem inappropriate, threatening, offensive, or harmful.
40+
41+
## Scope
42+
43+
This Code of Conduct applies both within project spaces and in public spaces when an individual is representing the project or its community. Examples of representing a project or community include using an official project e-mail address, posting via an official social media account, or acting as an appointed representative at an online or offline event. Representation of a project may be further defined and clarified by project maintainers.
44+
45+
## Enforcement
46+
47+
Instances of abusive, harassing, or otherwise unacceptable behavior may be reported by contacting the project team. All complaints will be reviewed and investigated and will result in a response that is deemed necessary and appropriate to the circumstances. The project team is obligated to maintain confidentiality with regard to the reporter of an incident. Further details of specific enforcement policies may be posted separately.
48+
49+
Project maintainers who do not follow or enforce the Code of Conduct in good faith may face temporary or permanent repercussions as determined by other members of the project's leadership.
50+
51+
---
52+
53+
<div align="center">
54+
<p>
55+
<a href="https://github.com/JCFcodex/AinzStack">Repository</a> •
56+
<a href="https://github.com/JCFcodex/AinzStack/issues">Issue Tracker</a>
57+
</p>
58+
<p>
59+
<small>Adopted from the <a href="https://www.contributor-covenant.org/">Contributor Covenant</a>, version 1.4</small>
60+
</p>
61+
</div>

‎CONTRIBUTING.md‎

Lines changed: 117 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,117 @@
1+
<div align="center">
2+
<img src="public/logo.png" alt="AinzStack Logo" width="64" />
3+
<br />
4+
<h1>Contributing to AinzStack</h1>
5+
</div>
6+
7+
<p align="center">
8+
<strong>Engineering rigor and clear communication form the basis of our collaboration.</strong><br/>
9+
<em>Thank you for dedicating your time to improving AinzStack.</em>
10+
</p>
11+
12+
---
13+
14+
## The Development Process
15+
16+
To maintain architectural integrity and codebase quality, all contributions must adhere to the following workflow:
17+
18+
### 1. Environment Setup
19+
20+
Fork the repository and clone your fork locally. Ensure you meet the system prerequisites outlined in the `README.md` (Node.js v22+, pnpm v10+).
21+
22+
```bash
23+
git clone https://github.com/[YOUR_USERNAME]/AinzStack.git
24+
cd AinzStack
25+
pnpm install
26+
```
27+
28+
### 2. Branching Strategy
29+
30+
Never commit directly to the `main` branch. Create a feature branch scoped to the specific issue or feature you are addressing.
31+
32+
```bash
33+
git checkout -b feature/brief-description
34+
# or
35+
git checkout -b fix/issue-description
36+
```
37+
38+
### 3. Making Changes
39+
40+
When modifying the codebase, adhere to these principles:
41+
42+
- **Consistency**: Match the existing architectural patterns (Next.js App Router conventions, Tailwind structure).
43+
- **TypeScript**: Rely on strict typing. Avoid `any` types.
44+
- **Modularity**: Keep UI components isolated within `src/components/ui/` or `src/components/shared/` where applicable.
45+
46+
### 4. Validation
47+
48+
Before staging your changes, ensure they pass the overarching quality control suite. Our Continuous Integration checks require zero errors.
49+
50+
Run the validation suite locally:
51+
52+
```bash
53+
pnpm ci
54+
```
55+
56+
Alternatively, run specific checks if you are isolating a failure:
57+
58+
| Command | Target |
59+
| :--------------- | :------------------------------ |
60+
| `pnpm lint` | Static code analysis |
61+
| `pnpm typecheck` | TypeScript compiler validation |
62+
| `pnpm test` | Unit testing (Vitest) |
63+
| `pnpm test:e2e` | End-to-end testing (Playwright) |
64+
65+
### 5. Committing Guidelines
66+
67+
We adhere strictly to [Conventional Commits](https://www.conventionalcommits.org/). This standard dictates the semantic versioning and changelog generation of the project.
68+
69+
**Format:**
70+
71+
```text
72+
<type>(<optional scope>): <description>
73+
```
74+
75+
**Permitted Types:**
76+
77+
- `feat`: A new feature
78+
- `fix`: A bug fix
79+
- `docs`: Documentation only changes
80+
- `style`: Changes that do not affect the meaning of the code (white-space, formatting, etc)
81+
- `refactor`: A code change that neither fixes a bug nor adds a feature
82+
- `test`: Adding missing tests or correcting existing tests
83+
- `chore`: Changes to the build process or auxiliary tools and libraries
84+
85+
**Example:**
86+
87+
```bash
88+
git commit -m "feat(auth): integrate multi-factor authentication layer"
89+
```
90+
91+
### 6. Pull Requests
92+
93+
Push to your fork and submit a Pull Request to the `main` branch of the upstream repository.
94+
95+
- Keep the PR highly scoped. Giant monolithic PRs are difficult to review and prone to rejection.
96+
- Fill out the PR template accurately.
97+
- Ensure the CI pipeline is passing (green checkmark).
98+
99+
## Project Structure Reference
100+
101+
When integrating new logic, please respect the established boundaries:
102+
103+
- `src/app/api/`: Edge and serverless routes. Do not place business logic directly in generic UI files.
104+
- `src/lib/`: External service intialization (Supabase clients, Stripe configuration).
105+
- `src/actions/`: Next.js Server Actions intended for form submissions and data mutation.
106+
107+
---
108+
109+
<div align="center">
110+
<p>
111+
<a href="https://github.com/JCFcodex/AinzStack">Repository</a> •
112+
<a href="https://github.com/JCFcodex/AinzStack/issues">Issue Tracker</a>
113+
</p>
114+
<p>
115+
<em>Built by <a href="https://github.com/JCFcodex">JCFcodex</a> and Contributors</em>
116+
</p>
117+
</div>

‎SECURITY.md‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
<div align="center">
2+
<img src="public/logo.png" alt="AinzStack Logo" width="64" />
3+
<br />
4+
<h1>Security Policy</h1>
5+
</div>
6+
7+
<p align="center">
8+
<strong>Vulnerability reporting and security guarantees for AinzStack.</strong>
9+
</p>
10+
11+
---
12+
13+
## Supported Versions
14+
15+
Currently, only the `main` branch and the latest minor release receive active security updates. We strongly encourage all developers to pull from the latest commits to ensure maximum architectural safety.
16+
17+
| Version | Supported | Notes |
18+
| :------ | :-------- | :-------------------------------------- |
19+
| `0.1.x` | ✅ Yes | Current active development branch. |
20+
| `< 0.1` | ❌ No | Prototype and pre-release architecture. |
21+
22+
## Reporting a Vulnerability
23+
24+
Security is a foundational tenet of the AinzStack architecture. We take all vulnerabilities in our code, dependencies, and infrastructure exceptionally seriously.
25+
26+
If you discover a security vulnerability within AinzStack, please do **not** disclose it publicly via GitHub Issues, Discussions, or social media.
27+
28+
### Process
29+
30+
1. **Private Disclosure**: Immediately email the repository owner or use the private GitHub Security Advisory system if available on the repository.
31+
2. **Details Required**: Provide a clear description of the vulnerability, steps to reproduce, and the potential impact. If possible, include a Proof of Concept (PoC).
32+
3. **Response**: We aim to acknowledge receipt of the vulnerability report within 48 hours and provide a preliminary assessment.
33+
4. **Resolution**: If the vulnerability is verified, we will develop a patch and issue a security advisory. We will typically coordinate public disclosure with you after the patch is published.
34+
35+
## Best Practices for AinzStack Consumers
36+
37+
When deploying applications built upon AinzStack, developers are responsible for their localized security context:
38+
39+
- **Environment Variables**: Never expose `STRIPE_SECRET_KEY`, `SUPABASE_SERVICE_ROLE_KEY`, or `RESEND_API_KEY` to the client. Ensure they do not map to `NEXT_PUBLIC_` prefixed variables.
40+
- **Row Level Security (RLS)**: AinzStack utilizes Supabase. You **must** ensure RLS is strictly enforced on your database tables in production to restrict unauthenticated or unauthorized data access.
41+
- **Middleware**: AinzStack protects dashboard routes via Next.js Middleware. Do not bypass or remove this without re-implementing strict session boundary checks.
42+
43+
---
44+
45+
<div align="center">
46+
<p>
47+
<a href="https://github.com/JCFcodex/AinzStack">Repository</a> •
48+
<a href="https://github.com/JCFcodex/AinzStack/security">Security Advisories</a>
49+
</p>
50+
<p>
51+
<em>Built by <a href="https://github.com/JCFcodex">JCFcodex</a></em>
52+
</p>
53+
</div>

0 commit comments

Comments
 (0)