# Contributing

Thanks for working on PR Previews. This project is a self-hosted Gitea PR
preview service; the product behavior source of truth is `SPEC.md`.

## Before You Change Code

- Read `AGENTS.md` for repository-specific implementation rules.
- Check `SPEC.md` when behavior is ambiguous.
- Use `pnpm`, not npm or yarn.
- Keep Prisma commands pointed at `../prisma/schema.prisma` from `backend/`.
- Do not commit generated secrets, `.env` files, EC2 keys, tokens, or database dumps.

## Development Setup

Start the database:

```bash
docker compose up -d pp-db
```

Apply migrations:

```bash
cd backend
pnpm migrate
```

Run the backend:

```bash
cd backend
pnpm install
pnpm dev
```

Run the frontend:

```bash
cd frontend
pnpm install
pnpm dev
```

## Validation

There is no automated test runner in this repository yet. Before opening a PR,
run the relevant builds:

```bash
cd backend
pnpm build
```

```bash
cd frontend
pnpm build
```

For behavior changes, also verify the running stack manually with a Gitea PR or
with the narrowest API/UI flow that exercises the change.

## Pull Request Guidelines

- Keep changes scoped to one behavior or cleanup.
- Explain user-visible behavior changes clearly.
- Include migration notes when changing `prisma/schema.prisma`.
- Preserve the existing security model: encrypted stored secrets, masked logs,
  constant-time webhook signature checks, and no secret values in API responses.
- Update `README.md`, `SPEC.md`, or `AGENTS.md` when the change affects setup,
  product behavior, or contributor workflow.

## License

By contributing, you agree that your contributions are licensed under the Apache
License, Version 2.0. See `LICENSE`.