|
1 | | -# Contributing Guide for OpenSCA-cli |
2 | | - |
3 | 1 | [中文](./CONTRIBUTING-zh_CN.md) | [English](./CONTRIBUTING.md) |
4 | 2 |
|
5 | | -We warmly welcome anyone who wants to provide improvement suggestions, submit bug reports, or submit new feature pull requests for OpenSCA-cli. This guide will help you understand how to make contributions to OpenSCA-cli. |
| 3 | +# Contributing Guideline-en |
| 4 | + |
| 5 | +## Contribution Guideline on OpenSCA Project v1.0 |
| 6 | + |
| 7 | +OpenSCA project is an open-source tool of software composition analysis originally developed by X-mirror. Situated in the fast-paced rhythm of development and an environment where open-source code and software are widely applied, the security problem of the software supply chain is glaring. To rise to the challenges, our solution is to manage the open-source risks through our open-source project. Everyone is warmly welcomed to be part of our community, constructing the future of OpenSCA project and fulfilling the potential of the open-source solution. |
| 8 | + |
| 9 | +We value all forms of contributions, including but not limited to: |
| 10 | + |
| 11 | +- Reviewing of the existing code |
| 12 | +- Documents and examples of deployment |
| 13 | +- Participating in the discussion through “Issue” on Github, our Wechat official account, Wechat group as well as QQ group |
| 14 | +- Improving the functionality of the project practically |
| 15 | +- Sharing the experience, offering using tips, and communicating on relevant topics to assist the further development of the project. |
| 16 | + |
| 17 | +To help the one gets interested in contributing to multiple aspects more effectively, we drafted this contribution guideline. It will be updated in accordance with the development of the project. The main parts of this guideline are as follows: |
| 18 | + |
| 19 | +- Code of Conduct and Contributing System |
| 20 | +- Report a BUG |
| 21 | +- Types of BUG |
| 22 | +- Contributing Code |
| 23 | +- Code Standard |
| 24 | + |
| 25 | +### Code of Conduct and Contributing System |
| 26 | + |
| 27 | +OpenSCA community aims to create a contributor-friendly atmosphere, where the open and inclusive environment of mutual respect requires our joint effort to build and maintain. The inappropriate behavior would face warnings or even punishments. |
| 28 | + |
| 29 | +#### Code of Conduct |
| 30 | + |
| 31 | +The community cares about the feelings of every member. For the promotion of a favorable atmosphere, please check our [Code of Conduct](https://github.com/XmirrorSecurity/OpenSCA-cli/blob/master/docs/CODE_OF_CONDUCT.md) in advance, and keep it in mind during your participation. |
| 32 | + |
| 33 | +#### Contributing System |
| 34 | + |
| 35 | +The emerging community is now run by OpenSCA project team. As the development of the community, we are expecting more people to make contributions and join our team, maintaining the operation of our community together. |
| 36 | + |
| 37 | +The current contributing system can be roughly divided into two parts: one about code and the other about points. For the code branch, you will become a contributor after contributing code through **Pull Request**s and getting accepted by the team. Then you'll be able to participate in the further plan and implementation for the project, judgment for the BUG, review the PR and verify new contributors. |
| 38 | + |
| 39 | +For the points branch, apart from gaining them through contributing code, it also works to actively get involved in reporting BUG, discussing relevant technology and sharing your experience of using OpenSCA. The points could exchange for gifts. The detailed rules of gaining and exchanging points could differ according to time or diverse activities. Please feel free to throw an email to Opensca@anpro-tech.com for the latest rules. |
| 40 | + |
| 41 | +### Report a BUG |
| 42 | + |
| 43 | +If you find a BUG while deploying or using OpenSCA, you can report it on "Issue". Should there be any problems with our docs, you can contact us through the aforementioned mailbox. |
| 44 | + |
| 45 | +Before reporting a BUG, it is advised to make sure that the latest version has been deployed. What's more, the BUG might have been reported on "Issue" by the others. If it indeed is a fresh one related to the latest version, you can either report it on "Issue" and wait for other members to deal with it, or make a PR to offer your solution and wait for verification. |
| 46 | + |
| 47 | +*Vulnerabilities are not suitable for open discussion. If you find any security vulnerabilities of OpenSCA, please contact us through the aforementioned mailbox. |
| 48 | + |
| 49 | +### Types of BUG |
| 50 | + |
| 51 | +Different types of BUG make different influences on the users who use OpenSCA. According to these differences, We classify the BUG into three types: |
| 52 | + |
| 53 | +**Major BUG**: the ones that affect major functionality (the analysis of the components and the identification of vulnerabilities in Java、PHP and other languages ) |
| 54 | + |
| 55 | +**Minor BUG**: the ones only cause inconvenience while using without affecting any functionality |
| 56 | + |
| 57 | +**Fake BUG**: the ones which caused by improper operation or using the old version |
6 | 58 |
|
7 | | -## Reporting Issues |
| 59 | +The major ones call for the top priority and our members will actively follow-up. But you can submit a PR for fixing it if you have any solution. It will be checked by our members. |
8 | 60 |
|
9 | | -If you encounter issues while using OpenSCA-cli, please submit a bug report on the GitHub Issues page. When submitting a bug report, please describe the issue in as much detail as possible, including: |
| 61 | +We will deal with the minor ones by tweaking parts of the existing code. As for the fake ones, we will reply in "Issue" to help you find the problem so that you can use OpenSCA smoothly. |
10 | 62 |
|
11 | | -- What you were doing when the issue occurred |
12 | | -- What you expected to see |
13 | | -- What actually happened |
14 | | -- Error messages (if any) |
15 | | -- Your operating system and version |
16 | | -- Your version of OpenSCA-cli |
| 63 | +### Contributing Code |
17 | 64 |
|
18 | | -Please provide the steps to reproduce the issue, if possible. This will help us understand and solve the problem more quickly. |
| 65 | +Code contributions are indispensable to the maintaining, improving and extension of OpenSCA. It can be done by submitting PR on Github. |
19 | 66 |
|
20 | | -## Submitting Improvement Suggestions |
| 67 | +Our team will review your PR, where both fixing a BUG or improving the functionality is welcome. In order to make it more effective, we hope that you can have a look at our code standard before organizing your PR. We advise that make ONE PR for ONE task at once. The readability also matters, so extra pieces of comments will be appreciated. |
21 | 68 |
|
22 | | -If you have any suggestions for improving OpenSCA-cli, you are also welcome to submit them on the Issues page. When you submit a suggestion, please explain your suggestion in detail and why it would improve OpenSCA-cli. |
| 69 | +If your PR is about **fixing a BUG**, based on the code standard, we will mainly focus on the quality of your code while verifying your contribution. |
23 | 70 |
|
24 | | -## Submitting Pull Requests |
| 71 | +If your PR is about **improving the functionality**, based on the code standard, we will review the code quality, creativity, functionality and algorithm. |
25 | 72 |
|
26 | | -If you want to add new features to OpenSCA-cli or fix bugs, you can fork the project, make changes on your branch, and then submit a pull request. |
| 73 | +We will reach out and invite you to sign our CLA (Contributor License Agreement) after we decide to approve your code. As long as CLA get signed, your code contribution will become part of OpenSCA project, and you will be one of our contributors. Contributors can take part in the further plan and implementation of the project, judgment for the BUG, review the PR and verify new contributors. |
27 | 74 |
|
28 | | -Before submitting your pull request, please make sure your code meets the following requirements: |
29 | 75 |
|
30 | | -- Complies with the project's coding style |
31 | | -- Has sufficient tests |
32 | | -- Updates relevant documentation (if any) |
33 | | -- Has no merge conflicts |
34 | | -- When submitting your pull request, please explain in detail the changes you made and why you made them. If your pull request is to solve an issue, please refer to the issue in your pull request. |
| 76 | +--- |
35 | 77 |
|
36 | | -Our maintainers will review your pull request as soon as possible. If everything meets the requirements, we will merge your code, and you will see your name in the list of project contributors. |
37 | 78 |
|
38 | | -## Contributor Code of Conduct |
| 79 | +We appreciate all the contributions to OpenSCA. |
39 | 80 |
|
40 | | -We hope that the OpenSCA community is an open and welcoming environment. Therefore, we require all contributors to adhere to our code of conduct. Please read and understand these guidelines before participating in the project. |
| 81 | +Thanks again for your interest in OpenSCA and your support for our solution to open source vulnerabilities. |
41 | 82 |
|
42 | | -Please remember, your contribution directly reflects the value and influence of the OpenSCA-cli community, and we deeply appreciate your contributions. |
| 83 | +For the Chinese version of our contributing guideline, please check [贡献指南（中文版）v1.0](./Contributing_Guideline-v1.0-zh_CN.md)。 |
0 commit comments