Thank you for helping improve Stratafetch. Keep pull requests focused, explain the operator-facing impact, and call out changes to security boundaries, stored content, provider behavior, or database migrations.
Requirements:
- Node.js 22 or newer and npm 10 or newer
- Docker with the Compose plugin
- Chromium installed through Playwright for browser-mode tests outside Docker
npm ci
npm run browsers:install
docker compose up -d postgres redis
npm run checkRun the API and worker in separate terminals with npm run dev and
npm run dev:worker. Do not use real provider credentials in tests, fixtures, logs, or
pull requests.
- Branch from the latest
main. - Add tests for behavioral changes and append-only migrations for schema changes.
- Run
npm run checkanddocker compose config --quiet. - Changing the egress path —
Dockerfile.egress,infra/egress/squid.conf,compose.yamlnetwork/proxy settings, or anything underapps/api/src/fetch/orapps/api/src/security/— also run./scripts/verify-egress.sh. It builds the real stack and probes it from inside theworkercontainer (network segmentation, Squid's ACLs, and an actual proxied fetch), not just unit tests against mocks. It needs a host with real internet egress for a full pass; a restricted network reports the internet-reaching checks as skipped rather than failed, with an explanation. CI (.github/workflows/security.yml) runs it on every push and PR. - Update the OpenAPI document and relevant operator documentation when a public contract changes.
- Describe validation performed and any remaining platform or security risk.
Public API compatibility is required after 1.0. Breaking /v1 changes need a new API
version and a documented migration path. Generated artifacts must be reproducible from
tracked source; do not edit generated OpenAPI output by hand.
Do not open a public issue for a suspected vulnerability. Follow SECURITY.md so maintainers can investigate before disclosure.
By contributing, you agree that your contribution is licensed under Apache-2.0.