Contributing

August 24, 2026 · View on GitHub

Read GOVERNANCE.md before proposing major changes.

Set Up

Install JDK 26, JDK 25, curl, tar, and unzip.

Use JDK 26 as JAVA_HOME.

Expose JDK 25 to the compatibility tests:

export SHRINKER_JAVA_HOME="/path/to/jdk-25"

The Gradle wrapper resolves locked, checksum-verified dependencies.

Never commit credentials or runtime environment files.

Most SDK files come from the public OpenAPI contract.

Preserve generated method names and response contracts.

Avoid generated-file changes when a generator fix exists.

Protect maintained runtime changes with focused regression tests.

Browse issues labeled good first issue.

Maintainers use that label for bounded documentation and test changes.

Comment on an issue before starting substantial work.

Ask for scope details when acceptance criteria are unclear.

Run focused tests while editing.

Run every gate before requesting review:

./scripts/lint
./scripts/test
./scripts/coverage
OSV_SCANNER_BIN=/path/to/osv-scanner ./scripts/audit
reuse lint
./scripts/check-reproducible

The audit script downloads a verified OSV Scanner when needed.

Maintained-source line coverage must remain at least 90%.

Maintained-source branch coverage must remain at least 80%.

The raw report keeps generated-source coverage visible.

Skipped tests are forbidden.

Add regression tests for every corrected defect.

Service tests accept literal loopback traffic only.

This guard prevents tests from mutating remote services.

Use clear Conventional Commit subjects and sign commits with git commit --signoff. Follow the shared review policy.

Never disclose suspected vulnerabilities in public issues.

Follow SECURITY.md for private reporting.

Publish an immutable v* release after its commit reaches main.

Verify the tag, changelog, audit, licensing, and reproducible artifacts.

Xquik is an independent third-party service. Not affiliated with X Corp. "Twitter" and "X" are trademarks of X Corp.