Applies to every Totative repository without its own CONTRIBUTING.md.
- Security problems go through the security policy, never an issue or pull request.
- Sign every commit; public repositories reject unsigned ones. Set up SSH commit signing before you open a pull request.
- One change per pull request, with the reason in the description. Required checks pass and a maintainer reviews before merge.
- A new dependency needs a reason in the pull request. Dependency review blocks known-vulnerable packages and disallowed licences.
- Workflows pin third-party actions to a full commit SHA and set least-privilege
permissions:per job.