# Contributing Everything about _how_ to build and test this project is in the [README](README.md#contributing) and in [`docs/`](docs/). This file is the other half: the terms a contribution arrives under, and the one mechanical step that records them. ## The licence your contribution is under GoodWorkshop is distributed under the **Apache License 2.0 with the Commons Clause** — see [LICENSE](LICENSE). Everybody who receives the project receives it under those terms, you included. **Your contribution itself is licensed under plain Apache-2.0, without the Commons Clause.** Section 5 of the Apache License already says that a contribution submitted for inclusion is under the terms of that licence; this file says which one is meant, so nobody has to argue about it later. The difference is practical: it lets roleALPHA GmbH, which maintains this project, keep offering GoodWorkshop under further terms — a hosted edition, for example — without having to find every contributor and ask. You keep the copyright in what you write, and there is no copyright assignment. It also keeps the DCO below accurate as written. It speaks of an "open source license", and plain Apache-2.0 is one — the Commons Clause, which is not, applies to the distributed project rather than to what you contribute. Up to `v0.3.1` this project was AGPL-3.0-only, and this file used to say that contributions under it could not be relicensed without asking every contributor. That was true. The change was possible only because, at that point, nobody outside roleALPHA had contributed. ## Sign your work — the Developer Certificate of Origin Every commit needs a `Signed-off-by` line. This is the [Developer Certificate of Origin](https://developercertificate.org/), the same lightweight mechanism the Linux kernel uses. It is not a contract and it does not transfer anything. It is you stating that you are allowed to contribute the code you are contributing. Git writes the line for you: ```bash git commit -s -m "Your message" ``` To sign off work you have already committed: ```bash git rebase --signoff main ``` CI checks this on every pull request and tells you exactly which commits are missing it. Commits made by bots are exempt — Dependabot cannot certify anything. ### What you are certifying By signing off you certify the following (DCO 1.1, verbatim): > By making a contribution to this project, I certify that: > > **(a)** The contribution was created in whole or in part by me and I have the right to submit > it under the open source license indicated in the file; or > > **(b)** The contribution is based upon previous work that, to the best of my knowledge, is > covered under an appropriate open source license and I have the right under that license to > submit that work with modifications, whether created in whole or in part by me, under the same > open source license (unless I am permitted to submit under a different license), as indicated > in the file; or > > **(c)** The contribution was provided directly to me by some other person who certified (a), > (b) or (c) and I have not modified it. > > **(d)** I understand and agree that this project and the contribution are public and that a > record of the contribution (including all personal information I submit with it, including my > sign-off) is maintained indefinitely and may be redistributed consistent with this project or > the open source license(s) involved. Note what (d) means for your privacy: your name and email address become a permanent, public part of the git history and cannot be removed later. Use an address you are willing to have published. GitHub's `@users.noreply.github.com` address is fine and is what most people use. ### Code you did not write yourself Two cases come up often enough to name: - **Code from another project.** Fine under (b), if its licence may ship under this project's terms — see the policy in [`scripts/licenses.mjs`](scripts/licenses.mjs). GPL and AGPL code cannot. Say where it came from in the commit message and keep its copyright header. - **Code an AI assistant generated.** You are the contributor and you sign off on it: (a) covers it, and the responsibility for it being yours to give is yours. Review it like any other code before you put your name on it. ## New dependencies A new dependency is a legal decision as much as a technical one, because it ends up inside an image other people run. CI fails if its licence is not in the allowlist in [`scripts/licenses.mjs`](scripts/licenses.mjs), and the index in [`THIRD-PARTY-LICENSES.md`](THIRD-PARTY-LICENSES.md) has to be regenerated: ```bash pnpm licenses:write ``` The diff that produces is the review. If the licence is genuinely fine and simply not in the allowlist yet, add it there **with the reason** — an entry without one is what the file exists to prevent. ## Security Do not open a public issue for a vulnerability. [SECURITY.md](SECURITY.md) has the private reporting route and what a useful report contains.