Skip to content

Commit c1c1dc7

Browse files
PigbibiPigbibi
authored
Improve open source documentation governance
Docs-only governance update. Validated with git diff --check and Markdown link checks.
1 parent c3d2e0d commit c1c1dc7

5 files changed

Lines changed: 112 additions & 0 deletions

File tree

‎CODE_OF_CONDUCT.md‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
# Code of Conduct
2+
3+
## 中文摘要
4+
5+
- 用途：本文档说明 QuantStrategyLab 仓库中的讨论、issue、pull request 和 review 行为规范。
6+
- 主要覆盖：`Our Standards`、`Project Scope`、`Reporting and Enforcement`。
7+
- 阅读顺序：参与讨论或提交 PR 前先确认沟通边界；发现不当行为时联系维护者。
8+
- 风险提示：涉及投资、交易、密钥或实盘系统的讨论必须保持克制、可复现和证据导向。
9+
10+
## Our Standards
11+
12+
- Be respectful, direct, and evidence-oriented in issues, pull requests, reviews, and discussions.
13+
- Assume technical disagreement is about the work. Keep feedback specific to code, docs, data, evidence, reproducibility, or operational risk.
14+
- Avoid harassment, insults, discriminatory language, personal attacks, and repeated off-topic comments.
15+
- Do not pressure maintainers or contributors to disclose private account details, credentials, trading records, unpublished data, or personal information.
16+
17+
## Project Scope
18+
19+
QuantStrategyLab repositories involve research, automation, strategy artifacts, and trading-support systems. Contributions should keep financial claims conservative and verifiable, separate research evidence from live-trading decisions, and avoid presenting examples as investment advice.
20+
21+
## Reporting and Enforcement
22+
23+
Report conduct concerns to the maintainer on GitHub: `@Pigbibi`. Maintainers may edit or remove comments, close issues or pull requests, restrict participation, or take other reasonable steps to protect contributors and project integrity.

‎CONTRIBUTING.md‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
# Contributing
2+
3+
## 中文摘要
4+
5+
- 用途：本文档说明如何向 `ResearchSignalContextPipelines` 提交低风险、可审阅的变更。
6+
- 主要覆盖：`Ground Rules`、`Documentation Standards`、`Branching and Pull Requests`、`Local Verification`。
7+
- 阅读顺序：先确认仓库边界和变更范围，再运行适合本仓库的本地校验。
8+
- 风险提示：涉及策略、artifact、自动化、密钥、云资源、券商或交易所行为的变更，必须先用测试环境、dry-run 或只读证据验证；不要只凭示例修改生产。
9+
- 英文正文保留更完整的命令、字段名和配置键；如果摘要和正文不一致，以正文中的实际命令和配置为准。
10+
11+
Thanks for contributing to `ResearchSignalContextPipelines`.
12+
13+
## Ground Rules
14+
15+
- Prefer small pull requests with one clear purpose.
16+
- Keep refactors separate from behavior, contract, workflow, or documentation changes.
17+
- Preserve this repository's boundary as a research signal context pipeline; do not move broker execution, live-allocation decisions, private credentials, or unrelated platform logic into it.
18+
- Add or update tests, examples, docs, or reproducible evidence when changing behavior or public contracts.
19+
20+
## Documentation Standards
21+
22+
- Keep `README.md` as the entry point for project purpose, boundary, repository layout, quick start, and links to deeper docs.
23+
- Put long-form runbooks, artifact contracts, evidence notes, and architecture details under `docs/` when they outgrow the README.
24+
- Document inputs, outputs, required permissions, risk controls, and validation commands for workflows or scripts that touch external systems.
25+
- Keep English and Chinese user-facing docs aligned when a change affects operators, contributors, or downstream platform users.
26+
27+
## Branching and Pull Requests
28+
29+
- Create a topic branch for each change.
30+
- Open a pull request with a concise summary, scope boundary, and concrete validation notes.
31+
- Wait for CI to pass before merging.
32+
- Do not include generated artifacts, private data, credentials, account identifiers, or local environment files unless the repository explicitly documents them as public examples.
33+
34+
## Local Verification
35+
36+
Run the lightweight whitespace check for every change and the repository test command when code, contracts, workflows, or examples change:
37+
38+
```bash
39+
git diff --check
40+
python -m pip install -e '.[test]'
41+
python -m pytest -q
42+
```
43+
44+
For documentation-only changes, at minimum review Markdown links, headings, and bilingual consistency before opening the pull request.

‎README.md‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,12 @@ python -m pytest -q
3737

3838
- [`docs/architecture.md`](docs/architecture.md)
3939

40+
## Community and security
41+
42+
- See [CONTRIBUTING.md](CONTRIBUTING.md) for pull request scope, local verification, and documentation expectations.
43+
- Follow [CODE_OF_CONDUCT.md](CODE_OF_CONDUCT.md) for maintainer and contributor conduct.
44+
- Report credential, automation, broker, exchange, or cloud-resource vulnerabilities through [SECURITY.md](SECURITY.md); do not open public issues for secrets or live-execution risk.
45+
4046
## License
4147

4248
See [LICENSE](LICENSE).

‎README.zh-CN.md‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,12 @@ python -m pytest -q
3737

3838
- [`docs/architecture.md`](docs/architecture.md)
3939

40+
## 社区和安全
41+
42+
- 贡献前请阅读 [CONTRIBUTING.md](CONTRIBUTING.md)，确认 PR 范围、本地校验和文档要求。
43+
- 讨论、issue 和 review 请遵守 [CODE_OF_CONDUCT.md](CODE_OF_CONDUCT.md)。
44+
- 涉及密钥、自动化、券商/交易所或云资源的漏洞请按 [SECURITY.md](SECURITY.md) 私密报告；不要为 secret 或实盘风险开公开 issue。
45+
4046
## 许可证
4147

4248
详见 [LICENSE](LICENSE)。

‎SECURITY.md‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
# Security Policy
2+
3+
## 中文摘要
4+
5+
- 用途：本文档说明如何报告 `ResearchSignalContextPipelines` 的安全问题，以及密钥或凭证暴露时的处理顺序。
6+
- 主要覆盖：`Reporting a Vulnerability`、`Secret and Credential Exposure`、`Scope Notes`。
7+
- 阅读顺序：发现问题后先避免公开泄露，再通过私密渠道提供最小复现信息。
8+
- 风险提示：涉及实盘、密钥、权限、Cloud Run、GitHub Actions、交易所或券商 API 的问题，不要开公开 issue 或贴出敏感日志。
9+
- 英文正文保留更完整的命令、字段名和配置键；如果摘要和正文不一致，以正文中的实际命令和配置为准。
10+
11+
Thanks for helping keep `ResearchSignalContextPipelines` safe.
12+
13+
This repository is part of the QuantStrategyLab automation, research, or trading-support surface. Please do **not** open a public issue for vulnerabilities involving credentials, broker or exchange access, cloud resources, workflow tokens, private market data, account identifiers, order execution, or secret material.
14+
15+
## Reporting a Vulnerability
16+
17+
- Contact the maintainer directly at GitHub: `@Pigbibi`.
18+
- If private vulnerability reporting is enabled for this repository, prefer that channel.
19+
- Include the repository name, affected commit or branch, environment details, and exact reproduction steps.
20+
- Share only the minimum logs, payloads, or screenshots needed to reproduce the issue, and redact secrets or account identifiers.
21+
22+
## Secret and Credential Exposure
23+
24+
If you suspect tokens, passwords, API keys, service-account keys, cookies, broker credentials, or workflow credentials were exposed:
25+
26+
1. Rotate the exposed secrets immediately.
27+
2. Pause scheduled jobs, deployments, or external integrations if the exposure can affect automation, artifact publishing, notifications, or trading behavior.
28+
3. Remove the exposed material from open pull requests, issues, logs, and artifacts.
29+
4. Coordinate any required history rewrite or downstream credential update with the maintainer.
30+
31+
## Scope Notes
32+
33+
Security fixes should stay minimal and focused. Please avoid bundling unrelated refactors, formatting churn, research changes, or feature work with a security report or patch.

0 commit comments

Comments
 (0)