Read GOVERNANCE.md before proposing major changes.
Follow the shared Xquik contribution policy.
Install PHP 8.3 or newer and Composer 2.10.2.
Install the locked development dependencies:
./scripts/bootstrapNever commit credentials or runtime environment files.
Most SDK files come from the public OpenAPI contract.
Preserve generated method names and response contracts.
Avoid generated-file changes when a generator fix exists.
Place stable examples outside generated directories.
Run focused tests while editing.
Run every gate before requesting review:
./scripts/lint
./scripts/test
./scripts/coverage
./scripts/audit
reuse lint
./scripts/check-reproducibleExecutable line coverage must remain at least 90%.
Branch coverage must remain at least 80%.
Add regression tests for every corrected defect.
Dynamic coverage measures the runtime core and service facades.
PHPStan validates every generated SDK type.
TEST_API_BASE_URL accepts literal loopback IPv4 only.
This guard prevents tests from mutating remote services.
Use clear Conventional Commit subjects and sign commits with git commit --signoff.
Follow the shared review policy.
Never disclose suspected vulnerabilities in public issues.
Follow SECURITY.md for private reporting.
Publish an immutable v* release after its commit reaches main.
Verify the tag, changelog, audit, licensing, and reproducible archive.
Xquik is an independent third-party service. Not affiliated with X Corp. "Twitter" and "X" are trademarks of X Corp.