docs: add CONTRIBUTING, SECURITY, and CODE_OF_CONDUCT (#83)

juhovainio · web-flow · commit be2321508a63 · 2026-07-07T12:47:04.000Z
* docs: add CONTRIBUTING, SECURITY, and CODE_OF_CONDUCT

Signed-off-by: Juho Vainio &lt;juho.vainio@amd.com&gt;

* add eof line

Signed-off-by: Juho Vainio &lt;juho.vainio@amd.com&gt;

* docs: replace README Contributing section with link

Signed-off-by: Juho Vainio &lt;juho.vainio@amd.com&gt;

---------

Signed-off-by: Juho Vainio &lt;juho.vainio@amd.com&gt;
diff --git a/.gitignore b/.gitignore
@@ -11,3 +11,4 @@ active-implementation-log.md
 current-user-asks.md
 __pycache__/
 /.hawkeye-bin/
+/.claude
diff --git a/CODE_OF_CONDUCT.md b/CODE_OF_CONDUCT.md
@@ -0,0 +1,49 @@
+<!--
+Copyright © Advanced Micro Devices, Inc., or its affiliates.
+
+SPDX-License-Identifier: MIT
+-->
+
+# Code of Conduct
+
+## Our Pledge
+
+We as contributors and maintainers pledge to make participation in this project a harassment-free experience for everyone, regardless of age, body size, disability, ethnicity, gender identity and expression, level of experience, nationality, personal appearance, race, religion, or sexual identity and orientation.
+
+## Our Standards
+
+Examples of behavior that contributes to a positive environment:
+
+- Using welcoming and inclusive language
+- Being respectful of differing viewpoints and experiences
+- Gracefully accepting constructive feedback
+- Focusing on what is best for the community and the project
+- Showing empathy toward other contributors
+
+Examples of unacceptable behavior:
+
+- The use of sexualized language or imagery, and unwelcome sexual attention or advances
+- Trolling, insulting or derogatory comments, and personal or political attacks
+- Public or private harassment
+- Publishing others' private information (physical or electronic addresses) without explicit permission
+- Other conduct which could reasonably be considered inappropriate in a professional setting
+
+## Our Responsibilities
+
+Project maintainers are responsible for clarifying the standards of acceptable behavior and are expected to take appropriate and fair corrective action in response to any instances of unacceptable behavior.
+
+Project maintainers have the right and responsibility to remove, edit, or reject comments, commits, code, issues, and other contributions that are not aligned with this Code of Conduct, or to temporarily or permanently ban any contributor for other behaviors that they deem inappropriate, threatening, offensive, or harmful.
+
+## Scope
+
+This Code of Conduct applies within all project spaces — including the GitHub repository, issue tracker, pull requests, and any other forums created by the project team — and also applies when an individual is officially representing the project in public spaces.
+
+## Enforcement
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may be reported by contacting the project maintainers via GitHub. All complaints will be reviewed and investigated promptly and fairly. The project team is obligated to maintain confidentiality with regard to the reporter of an incident.
+
+Project maintainers who do not follow or enforce the Code of Conduct in good faith may face temporary or permanent repercussions as determined by other members of the project's leadership.
+
+## Attribution
+
+This Code of Conduct is adapted from the [Contributor Covenant](https://www.contributor-covenant.org), version 2.1, available at <https://www.contributor-covenant.org/version/2/1/code_of_conduct/>.
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
@@ -0,0 +1,105 @@
+<!--
+Copyright © Advanced Micro Devices, Inc., or its affiliates.
+
+SPDX-License-Identifier: MIT
+-->
+
+# Contributing to ROCm CLI
+
+Thank you for your interest in contributing. This document explains how to get started, how work is tracked, and what to expect from the review process.
+
+## Code of Conduct
+
+By participating in this project you agree to abide by the [Code of Conduct](CODE_OF_CONDUCT.md).
+
+## Issue Tracking
+
+Bug reports and feature requests are tracked as [GitHub Issues](../../issues). Before opening a new issue, search existing ones to avoid duplicates.
+
+## Branch and Commit Naming
+
+Use [Conventional Commits](https://www.conventionalcommits.org/) for commit messages:
+
+```
+feat: add support for vLLM multi-GPU serving
+fix: correct VRAM probe when amd-smi is absent
+docs: clarify GPU selection flag behavior
+chore: bump rust-toolchain to 1.96
+```
+
+Branch names should be short and descriptive:
+
+```
+feat/vllm-multi-gpu
+fix/vram-probe-fallback
+```
+
+## Development Setup
+
+Prerequisites: Rust (see `rust-toolchain.toml` for the pinned version) and [uv](https://github.com/astral-sh/uv) (for prek and scripts).
+
+```bash
+git clone https://github.com/ROCm/rocm-cli
+cd rocm-cli
+uv tool install prek        # or: cargo install --locked prek
+prek install                # fast checks on every commit
+prek install -t pre-push    # heavier checks on push (clippy + tests)
+```
+
+`prek` runs the same checks locally that CI enforces: `cargo fmt`, `clippy`, `cargo test`, `ruff` (Python), `shellcheck` (shell), and PowerShell syntax.
+
+### Workspace layout
+
+| Path | Description |
+| --- | --- |
+| `apps/rocm` | Main CLI binary |
+| `apps/rocmd` | Background daemon |
+| `crates/rocm-core` | Core library |
+| `crates/rocm-dash-*` | Dashboard TUI libraries |
+| `crates/rocm-engine-protocol` | Engine IPC protocol |
+| `engines/` | Inference engine adapters (lemonade, vllm) |
+
+### Test commands
+
+| Component | Command |
+| --- | --- |
+| Rust (all crates) | `cargo test` |
+| Lint + format check | `prek run --all-files` |
+
+See `docs/testing.md` for the full test guide and `docs/manual-testing.md` for manual QA steps.
+
+## Making Changes
+
+1. **Fork** the repository and create a branch from `main`.
+2. **Make your changes.** Keep commits focused — one logical change per commit.
+3. **Add or update tests** for any new behavior.
+4. **Run the relevant test suite** before opening a PR.
+5. **Open a pull request** against `main` with a clear title and description following the Conventional Commits format.
+
+### Commit signing and sign-off
+
+Commits must be both cryptographically **signed** and carry a DCO **`Signed-off-by`** trailer. Use `git commit -s` to add the trailer automatically. This is enforced by the prek hooks and by a blocking CI check.
+
+Enable SSH signing once with:
+
+```bash
+git config --global gpg.format ssh
+git config --global user.signingkey ~/.ssh/id_ed25519.pub
+git config --global commit.gpgsign true
+```
+
+See `docs/commit-signatures.md` for GPG signing, GitHub "Verified" status, and troubleshooting.
+
+### What reviewers look for
+
+- Tests cover the new behavior
+- No secrets, credentials, or internal hostnames in committed files
+- Third-party dependencies declared in `Cargo.lock`; license headers present on new source files (see `licenserc.toml`)
+
+## Reporting Security Issues
+
+Do **not** open a public GitHub Issue for security vulnerabilities. See [SECURITY.md](SECURITY.md) for the responsible disclosure process.
+
+## License
+
+By contributing you agree that your contributions will be licensed under the [MIT License](LICENSE.TXT).
diff --git a/README.md b/README.md
@@ -340,29 +340,7 @@ rocm completions powershell | Out-String | Invoke-Expression
 
 ## Contributing
 
-This repo uses [prek](https://github.com/j178/prek) (a fast drop-in
-replacement for `pre-commit`) to run the same checks locally that CI enforces:
-`cargo fmt`, `clippy`, `cargo test`, `ruff` (Python), `shellcheck` (shell),
-and PowerShell syntax.
-
-```bash
-uv tool install prek        # or: cargo install --locked prek
-prek install                # fast checks on commit
-prek install -t pre-push    # heavier checks on push (clippy + tests)
-prek run --all-files        # run everything against the whole tree
-```
-
-Commits must be both cryptographically **signed** and carry a DCO
-**`Signed-off-by`** trailer (use `git commit -s`). This is enforced by the
-prek hooks above and by a blocking CI check. Enable signing once with:
-
-```bash
-git config --global gpg.format ssh
-git config --global user.signingkey ~/.ssh/id_ed25519.pub
-git config --global commit.gpgsign true
-```
-
-See `docs/commit-signatures.md` for details (GPG signing, GitHub "Verified", and troubleshooting).
+See [CONTRIBUTING.md](CONTRIBUTING.md).
 
 ## More docs
 
diff --git a/SECURITY.md b/SECURITY.md
@@ -0,0 +1,57 @@
+<!--
+Copyright © Advanced Micro Devices, Inc., or its affiliates.
+
+SPDX-License-Identifier: MIT
+-->
+
+# Security Policy
+
+This security policy outlines the process for reporting vulnerabilities and secrets found within this GitHub repository.
+It is essential that all contributors and users adhere to this policy in order to maintain a secure and stable environment.
+
+## Reporting a Vulnerability
+
+If you discover a vulnerability within the code, dependencies, or any other component of this repository, please follow these steps:
+
+1. **Do not disclose the vulnerability publicly.** Publicly disclosing a vulnerability may put the project at risk and could potentially harm other users.
+
+2. **Report the vulnerability privately** using [GitHub's private vulnerability reporting](../../security/advisories/new). Include the following information:
+   - The affected component(s)
+   - Steps to reproduce the issue
+   - Potential impact of the vulnerability
+   - Any possible mitigations or workarounds
+
+3. **Wait for a response from the maintainers.** Please be patient, as they may need time to investigate and verify the issue. The maintainers will acknowledge receipt of your report and provide an estimated time frame for addressing the vulnerability.
+
+4. **Cooperate with the maintainers.** If requested, provide additional information or assistance to help resolve the issue.
+
+5. **Do not disclose the vulnerability until the maintainers have addressed it.** Once the issue has been resolved, the maintainers may choose to publicly disclose the vulnerability and credit you for the discovery.
+
+## Reporting Secrets
+
+If you discover any secrets, such as API keys or passwords, within the repository, follow these steps:
+
+1. **Do not share the secret or use it for unauthorized purposes.** Misusing a secret could have severe consequences for the project and its users.
+
+2. **Report privately** using [GitHub's private vulnerability reporting](../../security/advisories/new). Include the secret's location and any potential risks associated with it.
+
+3. **Wait for a response and further instructions.**
+
+## Responsible Disclosure
+
+We encourage responsible disclosure of vulnerabilities and secrets. If you follow the steps outlined in this policy, we will work with you to understand and address the issue. We will not take legal action against individuals who discover and report vulnerabilities or secrets in accordance with this policy.
+
+## Patching and Updates
+
+We are committed to maintaining the security of our project. When vulnerabilities are reported and confirmed, we will:
+
+1. Work diligently to develop and apply a patch or implement a mitigation strategy.
+2. Keep the reporter informed about the progress of the fix.
+3. Update the repository with the necessary patches and document the changes in the release notes or changelog.
+4. Credit the reporter for the discovery, if they wish to be acknowledged.
+
+## Contributing to Security
+
+We welcome contributions that help improve the security of our project. If you have suggestions or want to contribute code to address security issues, please follow the standard contribution guidelines in [CONTRIBUTING.md](CONTRIBUTING.md). When submitting a pull request related to security, please mention that it addresses a security issue and provide any necessary context.
+
+By adhering to this security policy, you contribute to the overall security and stability of the project. Thank you for your cooperation and responsible handling of vulnerabilities and secrets.
