Skip to content

Contributing en

Jump to bottom
coolstartnow edited this page Aug 30, 2026 · 1 revision

Contributing

🇩🇪 Deutsche Version

Contributions are very welcome! The full reference is CONTRIBUTING.md in the repository — this page is the short version.

Getting started

git clone https://github.com/coolstartnow/isms-builder.git
cd isms-builder
npm install
cp .env.example .env     # adjust JWT_SECRET
npm start

Before you push

CI fails hard on three things. Check all three in one go:

npm run preflight

This is deliberately identical to what CI actually gates on:

Step Command
Test suite npm test
Pinned dependency check pdf-parse must be exactly 1.1.1 (see PINNED-DEPS.md)
Security audit npm audit --audit-level=high

Optional automation: a pre-push hook ships in .githooks/ — activate it once per working copy with git config core.hooksPath .githooks. From then on every git push runs preflight first; bypass a single push with git push --no-verify.

Development rules

  • All tests must pass before opening a PR — run npm run preflight
  • No new feature without a test — add a test file under tests/ for every new module
  • One route file per module — new modules go into server/routes/yourmodule.js
  • One store file per module — data access goes into server/db/yourmoduleStore.js
  • No secrets in code — use .env variables, never hard-code credentials
  • Soft-delete only — never hard-delete records from stores without a dedicated permanent-delete admin action

Found a security issue?

Please do not open a public issue — use private vulnerability reporting instead. SECURITY.md describes the scope, safe harbour, and what to realistically expect.

Good first issue

Look for issues labelled good first issue in the tracker.

Clone this wiki locally