We're so thankful you're considering contributing to an open source project of the U.S. government! If you're unsure about anything, just ask -- or submit the issue or pull request anyway. The worst that can happen is you'll be politely asked to change something. We appreciate all friendly contributions.
We encourage you to read this project's CONTRIBUTING policy (you are here), its LICENSE, and its README.
The following expectations apply to each PR:
- The PR and branch are named for automatic linking to the most relevant JIRA issue (for example,
JRA-123 Adds foofor PR title andjra-123-adds-foofor branch name). - Reviewers are selected to include people from all teams impacted by the changes in the PR.
- The PR has been assigned to the people who will respond to reviews and merge when ready (usually the person filing the review, but can change when a PR is handed off to someone else).
- The PR is reasonably limited in scope to ensure:
- It doesn't bunch together disparate features, fixes, refactorings, etc.
- There isn't too much of a burden on reviewers.
- Any problems it causes have a small blast radius.
- Changes will be easier to roll back if necessary.
- The PR includes any required documentation changes, including
READMEupdates and changelog or release notes entries. - All new and modified code is appropriately commented to make the what and why of its design reasonably clear, even to those unfamiliar with the project.
- Any incomplete work introduced by the PR is detailed in
TODOcomments which include a JIRA ticket ID for any items that require urgent attention.
see our .github/pull_request_template.md for more examples.
We adhere to the CMS Open Source Policy. If you have any questions, just shoot us an email.
Submit a vulnerability: Vulnerability reports can be submitted through Bugcrowd. Reports may be submitted anonymously. If you share contact information, we will acknowledge receipt of your report within 3 business days.
For more information about our Security, Vulnerability, and Responsible Disclosure Policies, see SECURITY.md.
This project is in the public domain within the United States, and copyright and related rights in the work worldwide are waived through the CC0 1.0 Universal public domain dedication.
All contributions to this project will be released under the CC0 dedication. By submitting a pull request or issue, you are agreeing to comply with this waiver of copyright interest.