mirror of https://github.com/snapotter-hq/SnapOtter.git synced 2026-08-03 07:46:42 +02:00

Files

T

SnapOtterandGitHub d10d0f544f fix: release QA hardening across processing, media, security, and CI gates (#649 )

A release-readiness QA pass over the whole product. The commits split into
defects a user would hit and gates that were reporting green while measuring
nothing.

## Fixes that change behaviour

Rate limiting was bypassable on every install: TRUST_PROXY defaulted to true, so
request.ip came from a client-set header and a forged X-Forwarded-For got past
the login limiter. The default is now a private-network trust list.

A transient Postgres outage stranded in-flight jobs, leaving finished output on
disk with no row pointing at it. A reconciler now resolves those rows and adopts
the bytes rather than dropping the work.

A Redis connection that moved to a new address wedged every read-blocked
consumer, so completions stopped signalling while health still answered 200.
Socket timeouts plus subscriber pings recover it.

Installing more than one AI bundle left the shared venv multi-versioned and
silently broke three tools. The installer now reconciles distributions to one
version each.

Converting an image to JXL at quality 1 through 4 returned a 500, because
libjxl 0.7 rejects the distance those values compute. The quality is floored at
what the encoder honours. A missing ffmpeg was also reported to the user as a
corrupt upload; it now says the engine is unavailable.

RAW uploads reached an unpatched LibRaw on arm64, so it is built from source at
0.22.2, and the release scan was split so it can fail on an unfixed critical
instead of hiding it behind ignore-unfixed.

## Gates that could not fail

Two mutation lanes ran zero mutants because Stryker crawled the gitignored docs
build; coverage discarded its whole report on any failing test; the lint gate
skipped root tests, scripts, and two workspaces; and several generated matrices
counted a host missing ffmpeg as a passing tool. Each now measures what it
claims.

Full evidence and the outstanding release items are tracked locally and are not
part of this branch.

2026-07-27 15:37:30 +08:00

5.6 KiB

Raw Permalink Blame History

Contributing to SnapOtter

Thanks for your interest in contributing. This guide covers how to participate, what we accept, and how to set up your development environment.

Ways to Contribute

Issues (no setup required)

Bug reports - Something broken? Open a bug report with reproduction steps.
Feature requests - Have an idea? Start a discussion so the community can weigh in and upvote it.
Translation issues - Spot a wrong or missing translation? Open a translation issue.
Documentation issues - Something off in the docs? Open a documentation issue.

Code (requires CLA)

We accept pull requests for:

Type	Process
Bug fixes	Open a PR directly (link the issue if one exists)
New translations	Open a PR directly (see Translation Guide)
Documentation improvements	Open a PR directly
Test coverage improvements	Open a PR directly
New tools or features	Start a discussion first; a maintainer converts approved ideas into a tracked issue before you write code
Refactors or architecture changes	Start a discussion first and wait for maintainer sign-off before writing code

What We Will Not Accept

Changes to CI/CD workflows, release config, or linter/compiler config
PRs without a signed Contributor License Agreement
PRs over 400 lines of change (break large work into smaller PRs)
Features that were not discussed and approved first
Changes to packages/ai/ without prior discussion

Contributor License Agreement

Before we can merge your first PR, you must sign our Individual CLA. This is a one-time requirement.

Why: SnapOtter is dual-licensed (AGPLv3 + commercial). The CLA grants us the right to distribute your contributions under both licenses. You retain full copyright ownership of your work.

How: When you open your first PR, the CLA Assistant bot will comment with a link. Click it, review the agreement, and sign with your GitHub account. Takes 30 seconds.

If you are contributing on behalf of your employer and your employer retains IP rights over your work, contact contact@snapotter.com to arrange a Corporate CLA before submitting.

Development Setup

Prerequisites

Node.js 22.22+
pnpm 9+
Python 3.11+ (only for AI tools)
Docker (optional, for full integration testing)

Getting Started

# Fork and clone
git clone https://github.com/<your-username>/snapotter.git
cd snapotter

# Install dependencies
pnpm install

# Start dev servers (web on :1351, API on :13490)
pnpm dev

Running Checks

Before submitting a PR, ensure all checks pass locally:

pnpm lint          # Biome lint + format check
pnpm typecheck     # TypeScript across monorepo
pnpm test          # Vitest unit + integration tests

To run a single test file:

pnpm vitest run tests/unit/my-test.test.ts
pnpm vitest run tests/integration/my-test.test.ts

Code Style

Biome handles formatting and linting (double quotes, semicolons, 2-space indent)
Pre-commit hook runs biome check --write on staged files automatically
If the linter complains, fix the code (do not modify Biome config)
ES modules everywhere (import/export, .js extensions on relative imports)
Conventional commits: feat:, fix:, refactor:, docs:, test:, chore:

Architecture Quick Reference

A tool lives in three places sharing a toolId string:

Shared metadata - packages/shared/src/constants.ts (TOOLS array)
API route - apps/api/src/routes/tools/<toolId>.ts (uses createToolRoute factory)
Frontend settings - apps/web/src/components/tools/<toolId>-settings.tsx

For full architecture details, see the Developer Guide.

Pull Request Process

Fork the repo and create a branch from main (feat/my-feature or fix/issue-123)
Make your changes in focused, reviewable commits using conventional commits
Add or update tests for your changes
Run pnpm lint && pnpm typecheck && pnpm test locally
Open a PR against main and fill out the template
Sign the CLA if prompted
Wait for CI to pass and a maintainer to review

Review Expectations

We aim to respond to PRs within 7 days
Small, focused PRs get reviewed faster
If you have not heard back in 7 days, leave a comment pinging the thread
We may request changes, suggest a different approach, or close the PR if it does not align with project direction

After Your PR is Merged

Your contribution will be included in the next release and credited in the changelog.

Security Vulnerabilities

Do not open a public PR or issue for security vulnerabilities. Report them privately through GitHub Security Advisories or email contact@snapotter.com. See SECURITY.md for full details.

Questions?

Documentation
Discord - for help and discussion
GitHub Discussions - for longer-form questions

5.6 KiB Raw Permalink Blame History