Skip to content

Commit 23ed921

Browse files
lachen-nvlachen-nv
authored
Merge pull request #24 from NVIDIA/docs/oss
docs: add contributing and security markdown
2 parents f435aa6 + f8ebef8 commit 23ed921

File tree

2 files changed

+186
-1
lines changed

2 files changed

+186
-1
lines changed

‎CONTRIBUTING.md‎

Lines changed: 175 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,175 @@
1+
# Contributing to dsx-github-actions
2+
3+
Thank you for your interest in contributing to dsx-github-actions! We welcome contributions from the community.
4+
5+
## Table of Contents
6+
7+
- [Developer Certificate of Origin (DCO)](#developer-certificate-of-origin-dco)
8+
- [Fork and Setup](#fork-and-setup)
9+
- [Contribution Process](#contribution-process)
10+
- [Pull Request Guidelines](#pull-request-guidelines)
11+
12+
## Developer Certificate of Origin (DCO)
13+
14+
dsx-github-actions requires the Developer Certificate of Origin (DCO) process to be followed for all contributions.
15+
16+
The DCO is a lightweight way for contributors to certify that they wrote or otherwise have the right to submit the code they are contributing. The full text of the DCO can be found at [developercertificate.org](https://developercertificate.org/):
17+
18+
```
19+
Developer Certificate of Origin
20+
Version 1.1
21+
22+
Copyright (C) 2004, 2006 The Linux Foundation and its contributors.
23+
24+
Everyone is permitted to copy and distribute verbatim copies of this
25+
license document, but changing it is not allowed.
26+
27+
28+
Developer's Certificate of Origin 1.1
29+
30+
By making a contribution to this project, I certify that:
31+
32+
(a) The contribution was created in whole or in part by me and I
33+
have the right to submit it under the open source license
34+
indicated in the file; or
35+
36+
(b) The contribution is based upon previous work that, to the best
37+
of my knowledge, is covered under an appropriate open source
38+
license and I have the right under that license to submit that
39+
work with modifications, whether created in whole or in part
40+
by me, under the same open source license (unless I am
41+
permitted to submit under a different license), as indicated
42+
in the file; or
43+
44+
(c) The contribution was provided directly to me by some other
45+
person who certified (a), (b) or (c) and I have not modified
46+
it.
47+
48+
(d) I understand and agree that this project and the contribution
49+
are public and that a record of the contribution (including all
50+
personal information I submit with it, including my sign-off) is
51+
maintained indefinitely and may be redistributed consistent with
52+
this project or the open source license(s) involved.
53+
```
54+
55+
### Signing Your Commits
56+
57+
To sign off on a commit, you must add a `Signed-off-by` line to your commit message. This is done by using the `-s` or `--signoff` flag when committing:
58+
59+
```bash
60+
git commit -s -m "Your commit message"
61+
```
62+
63+
**Tip:** You can create a Git alias to always sign off:
64+
65+
```bash
66+
git config --global alias.ci 'commit -s'
67+
# Now use: git ci -m "Your commit message"
68+
```
69+
70+
This will automatically add a line like this to your commit message:
71+
72+
```
73+
Signed-off-by: Your Name <your.email@example.com>
74+
```
75+
76+
Make sure your `user.name` and `user.email` are set correctly in your Git configuration:
77+
78+
```bash
79+
git config --global user.name "Your Name"
80+
git config --global user.email "your.email@example.com"
81+
```
82+
83+
### Signing Off Multiple Commits
84+
85+
If you have multiple commits that need to be signed off, you can use interactive rebase:
86+
87+
```bash
88+
git rebase HEAD~<number_of_commits> --signoff
89+
```
90+
91+
Or to sign off all commits in a branch:
92+
93+
```bash
94+
git rebase --signoff origin/main
95+
```
96+
97+
### DCO Enforcement
98+
99+
All pull requests are automatically checked for DCO complianc via DCO bot. Pull requests with unsigned commits cannot be merged until all commits are properly signed off.
100+
101+
## Fork and Setup
102+
103+
Developers must first fork the upstream [dsx-github-actions repository](https://github.com/NVIDIA/dsx-github-actions).
104+
105+
### 1. Fork the Repository
106+
107+
1. Navigate to the [dsx-github-actions repository](https://github.com/NVIDIA/dsx-github-actions) on GitHub.
108+
2. Click the **Fork** button in the upper right corner.
109+
3. Select your GitHub account as the destination.
110+
111+
### 2. Clone Your Fork
112+
113+
```bash
114+
git clone https://github.com/<your-username>/dsx-github-actions.git
115+
cd dsx-github-actions
116+
```
117+
118+
### 3. Add Upstream Remote
119+
120+
Add the original repository as an upstream remote to keep your fork in sync:
121+
122+
```bash
123+
git remote add upstream https://github.com/NVIDIA/dsx-github-actions.git
124+
git remote -v # Verify remotes
125+
```
126+
127+
### 4. Keep Your Fork Updated
128+
129+
Before starting new work, sync your fork with upstream:
130+
131+
```bash
132+
# Fetch upstream changes
133+
git fetch upstream
134+
135+
# Switch to main branch
136+
git checkout main
137+
138+
# Merge upstream changes
139+
git merge upstream/main
140+
141+
# Push to your fork
142+
git push origin main
143+
```
144+
145+
### 5. Create a Feature Branch
146+
147+
Always create a new branch for your changes:
148+
149+
```bash
150+
git checkout -b feature/your-feature-name
151+
```
152+
153+
Use descriptive branch names like:
154+
- `feature/add-new-api`
155+
- `fix/resolve-dhcp-issue`
156+
- `docs/update-readme`
157+
158+
## Contribution Process
159+
160+
1. **Fork the repository** and create your branch from `main`.
161+
2. **Make your changes** following our coding guidelines.
162+
3. **Sign off all your commits** using `git commit -s`.
163+
4. **Submit a pull request** with a clear description of your changes.
164+
165+
## Pull Request Guidelines
166+
167+
- Provide a clear description of the problem and solution.
168+
- Reference any related issues.
169+
- Keep pull requests focused on a single change.
170+
- Be responsive to feedback and code review comments.
171+
- Ensure all CI checks pass before requesting review.
172+
173+
## Questions?
174+
175+
If you have questions about contributing, please open an issue for discussion.

‎SECURITY.md‎

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22

33
NVIDIA is dedicated to the security and trust of our software products and services, including all source code repositories managed through our organization.
44

5-
If you need to report a security issue, please use the appropriate contact points outlined below. **Please do not report security vulnerabilities through GitHub.**
5+
If you need to report a security issue, please use the appropriate contact points outlined below. **Please do not report security vulnerabilities through GitHub.** If a potential security issue is inadvertently reported via a public issue or pull request, NVIDIA maintainers may limit public discussion and redirect the reporter to the appropriate private disclosure channels.
66

77
## Reporting Potential Security Vulnerability in an NVIDIA Product
88

@@ -12,3 +12,13 @@ To report a potential security vulnerability in any NVIDIA product:
1212
- We encourage you to use the following PGP key for secure email communication: [NVIDIA public PGP Key for communication](https://www.nvidia.com/en-us/security/pgp-key)
1313
- Please include the following information:
1414
- Product/Driver name and version/branch that contains the vulnerability
15+
- Type of vulnerability (code execution, denial of service, buffer overflow, etc.)
16+
- Instructions to reproduce the vulnerability
17+
- Proof-of-concept or exploit code
18+
- Potential impact of the vulnerability, including how an attacker could exploit the vulnerability
19+
20+
While NVIDIA currently does not have a bug bounty program, we do offer acknowledgement when an externally reported security issue is addressed under our coordinated vulnerability disclosure policy. Please visit our [Product Security Incident Response Team (PSIRT)](https://www.nvidia.com/en-us/security/psirt-policies/) policies page for more information.
21+
22+
## NVIDIA Product Security
23+
24+
For all security-related concerns, please visit NVIDIA's Product Security portal at https://www.nvidia.com/en-us/security

0 commit comments

Comments
 (0)