Improved documentation: Added CONTRIBUTING.md, CODE_OF_CONDUCT.md, and updated README.md #439
Conversation
WalkthroughTwo new documentation files, Changes
Assessment against linked issues
Poem
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (4)
CODE_OF_CONDUCT.md (1)
30-37: Minor wording nitpickLine 32 (“Trolling, insulting or derogatory comments…”) triggered a LanguageTool style hint about variety. Consider “harassing, insulting, or derogatory comments”. Purely stylistic; ignore if you prefer the current phrasing.
CONTRIBUTING.md (3)
20-21: Broken link:redme.mdtypo
docs/docker-compose/redme.md→readme.md. The current link 404s on GitHub.
12-16: Duplicate “Setup” heading – collapse for clarityYou have
## 🛠️ Setup Instructions(line 7) and a second## Setup(line 14). Merge them to avoid redundancy.
24-25: HTML<br>inside Markdown list may not render as intended
</br>is invalid HTML and unnecessary in GitHub lists. Replace with a blank line or<br/>.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (3)
CODE_OF_CONDUCT.md(1 hunks)CONTRIBUTING.md(1 hunks)README.md(1 hunks)
🧰 Additional context used
🪛 LanguageTool
CONTRIBUTING.md
[uncategorized] ~58-~58: You might be missing the article “the” here.
Context: ...ic key in tauri.conf.json as pubkey and private key and password in Environment Variabl...
(AI_EN_LECTOR_MISSING_DETERMINER_THE)
CODE_OF_CONDUCT.md
[style] ~32-~32: Try using a synonym here to strengthen your wording.
Context: ...ind * Trolling, insulting or derogatory comments, and personal or political attacks * Pu...
(COMMENT_REMARK)
[uncategorized] ~120-~120: You might be missing the article “the” here.
Context: ....org/version/2/0/code_of_conduct.html. Community Impact Guidelines were inspired by [Moz...
(AI_EN_LECTOR_MISSING_DETERMINER_THE)
🪛 Gitleaks (8.26.0)
CONTRIBUTING.md
63-63: Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
(generic-api-key)
🪛 markdownlint-cli2 (0.17.2)
CODE_OF_CONDUCT.md
3-3: Heading levels should only increment by one level at a time
Expected: h2; Actual: h3
(MD001, heading-increment)
🔇 Additional comments (2)
CODE_OF_CONDUCT.md (1)
1-3: Heading level jump flagged by markdown-lint — verify before merging
markdownlint-cli2raisedMD001(“heading levels should only increment by one”) at line 3.
Inspection looks fine (#➜##), but the linter’s complaint suggests something else (perhaps a hidden heading or an extra###in the raw file). Run the linter locally and fix/ignore as appropriate so CI stays green.README.md (1)
58-60: Nice delegation to CONTRIBUTING.mdThe slimmed-down README keeps the front page concise while pushing details to the new guide. Good move.
| There is a preset pubkey in tauri.conf.json ; private key and password for it is: | ||
|
|
||
| ```bash | ||
| TAURI_SIGNING_PRIVATE_KEY=dW50cnVzdGVkIGNvbW1lbnQ6IHJzaWduIGVuY3J5cHRlZCBzZWNyZXQga2V5ClJXUlRZMEl5NlF2SjE3cWNXOVlQQ0JBTlNITEpOUVoyQ3ZuNTdOSkwyNE1NN2RmVWQ1a0FBQkFBQUFBQUFBQUFBQUlBQUFBQU9XOGpTSFNRd0Q4SjNSbm5Oc1E0OThIUGx6SS9lWXI3ZjJxN3BESEh1QTRiQXlkR2E5aG1oK1g0Tk5kcmFzc0IvZFZScEpubnptRkxlbDlUR2R1d1Y5OGRSYUVmUGoxNTFBcHpQZ1dSS2lHWklZVHNkV1Byd1VQSnZCdTZFWlVGOUFNVENBRlgweUU9Cg== | ||
| ``` | ||
|
|
||
| ```bash | ||
| TAURI_SIGNING_PRIVATE_KEY_PASSWORD=pass | ||
| ``` |
There was a problem hiding this comment.
Private signing key is published – remove immediately
The Base-64 blob at line 63 is a private Tauri signing key, and the matching password is disclosed at line 67. Anyone can now create a malicious build that verifies as official. Delete the secret, revoke the key, and update the docs to instruct contributors to generate keys locally.
-There is a preset pubkey in tauri.conf.json ; private key and password for it is:
-
-```bash
-TAURI_SIGNING_PRIVATE_KEY=...
-```
-```bash
-TAURI_SIGNING_PRIVATE_KEY_PASSWORD=pass
-```
+# IMPORTANT: Never commit or publish private signing keys.
+# Each contributor MUST generate their own key-pair:
+# ```bash
+# npm run tauri signer generate
+# ```🧰 Tools
🪛 Gitleaks (8.26.0)
63-63: Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
(generic-api-key)
🤖 Prompt for AI Agents
In CONTRIBUTING.md around lines 60 to 68, remove the published private signing
key and its password to prevent security risks. Replace this section with a
clear instruction for contributors to generate their own key-pair locally using
the command "npm run tauri signer generate". Ensure no private keys or passwords
are included in the repository or documentation.
|
I have successfully resolved this issue. If the maintainer finds these changes useful, please consider merging this pull request. |
|
@rahulharpal1603 Sure |
Please pull the latest changes in the main repository into your branch. |
2 participants
This PR improves the project's documentation by:
Adding a CONTRIBUTING.md with setup and contribution guidelines
Adding a CODE_OF_CONDUCT.md to ensure a respectful contributor environment
Updating the README.md
These changes aim to make it easier for new contributors to get started and align the repo with open-source best practices.
closes #431
Summary by CodeRabbit