docs: add CONTRIBUTING.md and SECURITY.md - #149
Merged
Conversation
Two standard community-health files needed before flipping the
repository to public:
- CONTRIBUTING.md: where to file what (upstream vs fork), branch
model, local validation commands, commit style, PR expectations.
- SECURITY.md: private vulnerability reporting via GitHub Security
tab as primary channel, security@nudgebee.com as fallback, scope
+ supported-versions policy.
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces CONTRIBUTING.md and SECURITY.md files to establish contribution guidelines and security reporting procedures for the repository. The reviewer identified a versioning typo for golangci-lint in the contribution guide and recommended removing the security email address if it is not yet monitored to ensure vulnerability reports are not missed.
Removes the 'main → prod' branch model from CONTRIBUTING.md and the 'latest tag on prod branch' wording from SECURITY.md. Repo is moving to single-branch with releases cut as semver tags on main rather than promotions to a long-lived prod branch.
RamanKharchee
approved these changes
May 12, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Adds two community-health files required before flipping the repo to public:
CONTRIBUTING.md— directs contributors based on whether the issue is upstream (FairwindsOps/nova) or fork-specific. Documents themain→prodbranch model, local validation commands (matching what CI runs), conventional-commit style, PR expectations, and license/grant note.SECURITY.md— establishes private vulnerability reporting via GitHub's Security tab as the primary channel andsecurity@nudgebee.comas a fallback. States scope (this repo only — upstream goes to Fairwinds), expected response timelines (3-day ack, 10-day initial assessment), and that only the latestprodtag is patched.Review Notes — Risks & Counterarguments
security@nudgebee.comis named but not verified to exist in this PR — if that address isn't actually monitored, the SECURITY.md should be updated before going public, or that line removed in favor of GitHub PVR only.prodtag" — there is currently no tagged release. The first release should be cut before this policy is meaningful.main → prodas the actual flow. Direct pushes tomainandprodare stated as not accepted; branch protection currently allows force pushes on main — that's a separate fix (worth doing before going public).How Has This Been Tested?
README.md,NOTICE,LICENSE,.github/pull_request_template.md,.github/ISSUE_TEMPLATE/,.github/workflows/ci.yaml) all point to files that exist onmain.