Validate URLs against supply-chain attacks

[rails.git] / CONTRIBUTING.md

diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 477e8c63f5f9272b2fb99e27bddeb6478b286168..aaa1b5d4b555b960d3d5a258e660c78f0ff6afe3 100644 (file)
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -1,17 +1,18 @@
-* http://www.ruby-lang.org/ - The homepage of Ruby which has more links and some great tutorials.
+* https://www.ruby-lang.org/ - The homepage of Ruby which has more links and some great tutorials.
 * http://rubyonrails.org/ - The homepage of Rails, also has links and tutorials
 
 ## Coding style
 
-When writing code it is generally a good idea to try and match your
-formatting to that of any existing code in the same file, or to other
-similar files if you are writing new code. Consistency of layout is
-far more important than the layout itself as it makes reading code
-much easier.
+We use [Rubocop](https://github.com/rubocop-hq/rubocop) (for ruby files)
+and [ERB Lint](https://github.com/Shopify/erb-lint) (for erb templates)
+to help maintain consistency in our code. You can run these utilities during
+development to check that your code matches our guidelines:
 
-One golden rule of formatting -- please don't use tabs in your code
-as they will cause the file to be formatted differently for different
-people depending on how they have their editor configured.
+```
+bundle exec rubocop
+bundle exec rake eslint
+bundle exec erblint .
+```
 
 ## Testing
 
@@ -32,18 +33,22 @@ functionality.
 You can run the existing test suite with:
 
 ```
-bundle exec rake test
+bundle exec rails test:all
 ```
 
-You can generate test coverage stats with:
+You can view test coverage statistics by browsing the `coverage` directory.
+
+The tests are automatically run on Pull Requests and other commits via github
+actions. The results shown are within the PR display on github.
+
+## Static Analysis
+
+We also perform static analysis of our code. You can run the analysis yourself with:
 
 ```
-sudo gem install rcov
-rcov -x gems test/*/*.rb
+bundle exec brakeman -q
 ```
 
-The tests are automatically run on commit with the results shown at [http://cruise.openstreetmap.org/](http://cruise.openstreetmap.org/)
-
 ## Comments
 
 Sometimes it's not apparent from the code itself what it does, or,
@@ -58,13 +63,21 @@ might be difficult to understand what the code does, why it does it
 and why it should be the way it is.
 * Check existing comments to ensure that they are not misleading.
 
-## Code Documentation
+## i18n
 
-To generate the HTML documentation of the API/rails code, run the command
+If you make a change that involve the locale files (in `config/locales`) then please
+only submit changes to the `en.yml` file. The other files are updated via
+[Translatewiki](https://translatewiki.net/wiki/Translating:OpenStreetMap) and should
+not be included in your pull request.
 
-```
-rake doc:app
-```
+### Nominatim prefixes
+
+I18n keys under the `geocoder.search_osm_nominatim` keyspace are managed by the
+Nominatim maintainers. From time to time they run stats over the Nominatim
+database, and update the list of available keys manually.
+
+Adding or removing keys to this list is therefore discouraged, but contributions
+to the descriptive texts are welcome.
 
 ## Committing
 
@@ -93,7 +106,6 @@ If you have forked on GitHub then the best way to submit your patches is to
 push your changes back to GitHub and then send a "pull request" on GitHub.
 
 Otherwise you should either push your changes to a publicly visible git repository
-and send the details to the [rails-dev](http://lists.openstreetmap.org/listinfo/rails-dev)
+and send the details to the [rails-dev](https://lists.openstreetmap.org/listinfo/rails-dev)
 list or generate patches with `git format-patch` and send them to the
-[rails-dev](http://lists.openstreetmap.org/listinfo/rails-dev) list.
-
+[rails-dev](https://lists.openstreetmap.org/listinfo/rails-dev) list.