How to Contribute

[side-quest2001]

Hi I was looking to contribute but the markdowns for hard-runner do not contain any specifics or sops. Would love to see if anyone can help me out with that!

[SirHegel]

You are right that the current main branch does not contain a CONTRIBUTING.md, so there is no complete documented SOP yet. The repository does expose enough through its package scripts and PR workflow to reconstruct the current mechanical path:

1. Fork the repository, branch from main, and keep the change focused.

2. Install exactly the locked dependencies:

   npm ci

3. Add or update a colocated src/*.test.ts test for behavioral changes.

4. Run the available repository checks:

   npm test -- --coverage
   npm run lint
   npm run build

   npm run lint is a package script. The current PR workflow explicitly enforces the coverage test and build steps.

5. Include generated dist/ changes whenever the TypeScript source changes. This is a JavaScript action: action.yml executes dist/pre/index.js, dist/index.js, and dist/post/index.js directly. PR CI rebuilds those bundles and fails if the committed output is stale. After making the final commit, rerun the build and confirm:

   git status --porcelain dist

   prints nothing.

6. Open the PR against main with a short problem statement, the chosen approach, and the exact tests run. For a large feature, it is safer to ask maintainers to confirm the scope in an issue or discussion first.

The action declares the Node 24 runtime, but the repository does not currently pin a local development version through engines, packageManager, or .nvmrc. Node 24 is a reasonable local match, not a documented contributor requirement; the supported development versions still need maintainer confirmation.

The canary workflow is maintainer-side: it updates an RC tag and requires a repository PAT, so an external contributor is not expected to reproduce it locally. Unit tests, the reproducible bundle check, and the other configured checks run after the pull request is opened.

For security vulnerabilities, do not open a public issue or PR; follow SECURITY.md and report them privately.

A useful small first proposal to confirm with the maintainers would be a CONTRIBUTING.md that codifies this workflow and pins the supported Node/npm versions.