chore: add SECURITY.md, CONTRIBUTING.md, and Dependabot#76
Conversation
Document security reporting, contributor workflow, and enable weekly dependency updates for Go modules and GitHub Actions. Fixes dolph#29
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: a8ab04fa42
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| ## Pull requests | ||
|
|
||
| - One logical change per PR; link the issue (`Fixes #N`). | ||
| - Run `go test ./...` and `go vet ./...` before pushing. |
There was a problem hiding this comment.
For contributors who rely on this checklist before pushing Go changes, this omits the race detector even though the repo instructions and CI require go test -race ./.... That makes the local contribution guide weaker than the enforced development loop, so goroutine-related regressions may only be caught after push or missed by contributors validating locally; please document the race command here.
Useful? React with 👍 / 👎.
|
|
||
| ## Labels | ||
|
|
||
| Maintainers use `release:*` labels on PRs that should appear in release notes. If your change is user-visible, mention the desired release note in the PR body. |
There was a problem hiding this comment.
The checked release workflow defaults a merged PR with no release:* label to release:patch, while the repo instructions require every PR to choose release:skip, release:patch, release:minor, or release:major. Describing these labels as only for PRs that should appear in release notes can lead docs/test PRs to be merged unlabeled and cut unintended patch releases instead of being skipped.
Useful? React with 👍 / 👎.
1 participant
Summary
Fixes #29. Adds contributor/security docs and weekly Dependabot updates for Go modules and GitHub Actions.
Test plan
Made with Cursor