plugins/registry/README.md explains that a plugin is an MCP server and walks
from getting the server ready to the pull request, with every field, how
Verified is proven, what review checks, and a checklist for coding agents.
plugins/README.md and CONTRIBUTING.md point to it.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The root LICENSE names the folder, which holds its own copy of the Business
Source License. CODEOWNERS gives it to the maintainers, and code-quality.yml
fails a pull request from anyone else that touches either proprietary/ folder,
so SurfSense holds all of that code's copyright and needs no contributor
agreement. The docs and ADRs say so.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
code-quality.yml ran every pre-commit hook minus a skip list in each job, so
newer hooks leaked in: check-docs ran four times per PR, the translation hooks
ran in every job, and Biome ran on every PR whether the web app changed or not.
The desktop backend had no security scan at all, the gates counted a cancelled
or timed-out job as passing, and hooks pinned tool versions a second time.
- code-quality.yml keeps only what belongs to no product, run by hook name on
every PR: file checks, check-docs and detect-secrets
- docker-tests.yml replaces backend-tests.yml and e2e-tests.yml for
surfsense_backend and surfsense_web: ruff, bandit, Biome, backend unit and
integration tests, and the e2e journey, each job run only when its files
change
- desktop-tests.yml filters per job instead of per workflow, adds bandit for
the desktop backend, and checks translations, failing on a stale en.json
that typecheck used to regenerate silently
- each workflow ends in a gate (Docker Gate, Desktop Gate, Quality Gate) that
always reports and fails on failed or cancelled jobs, so it can be made a
required check without blocking PRs that don't touch that product
- bandit is split into bandit-docker and bandit-desktop aliases, so each
product scans only its own code
- the Biome hook runs only when a commit touches surfsense_web, instead of
blocking every commit on the app's existing formatting errors
- Biome and formatjs run from each app's own install (pnpm exec, and a new
translations:verify script), so their versions live only in package.json
- hook versions updated: pre-commit-hooks v6.0.0, bandit 1.9.4, commitizen
v4.19.0, and ruff v0.15.8 to match surfsense_backend's own ruff
- surfsense_web's pnpm comes from its own package.json and the root
package.json is removed; every action is on its latest version
- CONTRIBUTING.md, docs/contracts/README.md, auth_mint.py, the translate
skill and localization.md name the new workflows and commands
Move the engineering specs out of plans/ into a root docs/ folder.
architecture/ describes what is true in the code now, one doc per
feature. adr/ records decisions: 0003 is restored and 0004-0027 are
new. proposals/ holds designs not built yet: plugins and the CUDA
backend. contracts/ holds the frozen interfaces between trees, with
the fixtures their tests read. ROADMAP.md names the initiatives.
The shipped phase plans are deleted; git history keeps them. plans/
keeps business, launch and ops material only.
Also: CONTRIBUTING.md rewritten around this flow, a CODEOWNERS file,
a Docs section in AGENTS.md, scripts/check_docs.py (was
check_plan_links.py) as a pre-commit hook, the backend tests path
filter extended to docs/contracts, and the five tests that read the
contract fixtures pointed at their new path.
Co-authored-by: Cursor <cursoragent@cursor.com>
Replace the Docker-first contributing guide with a short index, current Covenant 3.0, private security reports, and issue forms that name the four products.
The Code Quality section sends a new contributor to ./PRE_COMMIT.md, which
is not in the repository, and then names Black and Prettier as the project's
formatters. .pre-commit-config.yaml runs ruff, ruff-format and biome; neither
Black nor Prettier is configured anywhere.
Replaces the dead link with the install command and the config file itself,
so the list of hooks cannot drift out of date again, and corrects the two
formatter names.
