From a5a0a3c6f940be99557880f2a65b24f78fc01fc4 Mon Sep 17 00:00:00 2001 From: TPTBusiness Date: Thu, 9 Apr 2026 15:17:49 +0200 Subject: [PATCH] docs: Update SECURITY.md and CONTRIBUTING.md SECURITY.md: - Removed placeholder email (nico@predix.io) - Added GitHub Security Advisories link - Added clear reporting process CONTRIBUTING.md: - Added Predix-specific development workflow - Branch naming conventions (feat/, fix/, docs/, etc.) - Conventional commit format with examples - Test requirements (>80% coverage) - Pre-commit hooks requirements - Project structure overview - Never/Always commit rules --- CONTRIBUTING.md | 178 +++++++++++++++++++++++++++++++++++++++--------- SECURITY.md | 21 +++--- 2 files changed, 158 insertions(+), 41 deletions(-) diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 5a46f348..5a567cf4 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -9,42 +9,158 @@ To get started, you can explore the issues list or search for `TODO:` comments i grep -r "TODO:" ``` -## How to Contribute +## Development Workflow -1. **Fork the Repository**: Create a fork of the repository on GitHub. -2. **Clone the Repository**: Clone your forked repository to your local machine. - ```sh - git clone https://github.com/your-username/predix.git - ``` -3. **Create a Branch**: Create a new branch for your changes. - ```sh - git checkout -b feature/your-feature-name - ``` -4. **Make Changes**: Make your changes to the codebase. -5. **Commit Changes**: Commit your changes with a descriptive commit message. - ```sh - git commit -m "Description of your changes" - ``` -6. **Push Changes**: Push your changes to your forked repository. - ```sh - git push origin feature/your-feature-name - ``` -7. **Ensure CI Passes**: Make sure your code passes the automatic CI checks on GitHub. -8. **Create a Pull Request**: Create a pull request from your forked repository to the main repository. +### 1. Fork and Clone -## Code of Conduct +```bash +# Fork the repository on GitHub, then clone your fork +git clone https://github.com/YOUR-USERNAME/Predix.git +cd Predix -Please adhere to the [Code of Conduct](CODE_OF_CONDUCT.md) in all your interactions with the project. +# Add upstream remote +git remote add upstream https://github.com/TPTBusiness/Predix.git +``` -## Reporting Issues +### 2. Create a Branch -If you encounter any issues or have suggestions for improvements, please open an issue on GitHub. +```bash +# Use conventional commit prefixes in branch names +git checkout -b feat/your-feature-name +# or +git checkout -b fix/bug-description +git checkout -b docs/documentation-update +git checkout -b refactor/code-cleanup +``` -## Guidelines +**Branch naming convention:** +- `feat/` - New features +- `fix/` - Bug fixes +- `docs/` - Documentation changes +- `refactor/` - Code refactoring +- `test/` - Test additions/fixes +- `chore/` - Maintenance tasks -- Ensure your code follows the project's coding standards. -- Write clear and concise commit messages. -- Update documentation as needed. -- Test your changes thoroughly before submitting a pull request. +### 3. Make Your Changes -Thank you for contributing to Predix! +Follow the project conventions: + +- **Code style**: Use type hints, docstrings (Google style), and 120 char line limit +- **Language**: All comments and documentation MUST be in English +- **Structure**: Follow the existing module structure + +### 4. Write Tests + +**MANDATORY:** All new features MUST have tests with >80% coverage. + +```bash +# Run tests +pytest test/ -v + +# Run with coverage +pytest --cov=rdagent --cov-report=html + +# Run integration tests +pytest test/integration/ -v +``` + +### 5. Run Pre-commit Hooks + +Pre-commit hooks run automatically before EVERY commit: + +```bash +# Install pre-commit +pre-commit install + +# Run manually +pre-commit run --all-files +``` + +### 6. Commit Your Changes + +Use [Conventional Commits](https://www.conventionalcommits.org/) format: + +```bash +git commit -m "type: description" + +# Types: +# feat: New feature +# fix: Bug fix +# docs: Documentation +# style: Formatting +# refactor: Code restructuring +# test: Tests +# chore: Maintenance +``` + +**Examples:** +```bash +git commit -m "feat: Add Optuna hyperparameter optimization" +git commit -m "fix: Resolve database connection timeout" +git commit -m "docs: Update README with new CLI commands" +git commit -m "test: Add integration tests for portfolio optimizer" +``` + +### 7. Push and Create a Pull Request + +```bash +git push origin your-branch-name +``` + +Then open a Pull Request on GitHub with: +- Clear title (use conventional commit format) +- Description of changes +- Link to related issues +- Screenshots (for UI changes) + +## Code Review Process + +All PRs are reviewed by maintainers. Expect: +- Automated checks (tests, linting, security scan) +- Code review by maintainers +- Possible requested changes + +## Important Rules + +### 🚫 NEVER COMMIT + +- `.env` files or API keys +- Generated data (`results/`, `*.db`, `*.log`) +- Closed-source assets (`models/local/`, `prompts/local/`) +- JSON strategy files in root directory +- Private credentials or tokens + +### ✅ ALWAYS DO + +- Write tests for new features +- Update documentation for user-visible changes +- Run `pre-commit run --all-files` before pushing +- Keep commit messages in English +- Follow conventional commit format + +## Project Structure + +``` +Predix/ +├── rdagent/ # Core framework (open source) +│ ├── app/ # CLI and scenario apps +│ ├── components/ # Reusable agent components +│ └── scenarios/ # Domain-specific scenarios +├── test/ # Test suite +├── docs/ # Documentation +├── scripts/ # Utility scripts +├── prompts/ # LLM prompts +├── models/ # ML models (standard only) +├── constraints/ # Python version constraints +└── requirements/ # Dependency files +``` + +## Need Help? + +- **Issues**: [GitHub Issues](https://github.com/TPTBusiness/Predix/issues) +- **Discussions**: [GitHub Discussions](https://github.com/TPTBusiness/Predix/discussions) +- **Documentation**: See `docs/` folder + +## License + +By contributing, you agree that your contributions will be licensed under the MIT License. diff --git a/SECURITY.md b/SECURITY.md index 4f7c6753..cb392753 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -2,19 +2,20 @@ ## Reporting a Vulnerability -We take the security of Predix seriously. If you believe you have found a security vulnerability, please report it to us as described below. +We take the security of Predix seriously. If you believe you have found a security vulnerability, please report it responsibly. **Please do not report security vulnerabilities through public GitHub issues.** -Instead, please report them via email to: -- **Email**: nico@predix.io +### How to Report -You should receive a response within 48 hours. If for some reason you do not, please follow up via email to ensure we received your original message. +1. **Open a private security advisory** on GitHub: https://github.com/TPTBusiness/Predix/security/advisories +2. Provide a detailed description of the vulnerability +3. Include steps to reproduce if possible +4. We will respond within 48 hours -## Preferred Languages +### What to Expect -We prefer all communications to be in English. - -## Security Updates - -Security updates will be released as patch versions. Please ensure you are using the latest version of Predix to benefit from security fixes. +- We will acknowledge your report within 48 hours +- We will investigate and provide updates regularly +- Once resolved, we will credit you in the release notes (if desired) +- Please allow reasonable time for us to address the issue before public disclosure