Contributing

Same slot as on secureblue.dev. Two different projects. Do not mix the repos.

Unwoke SecureBlue

Issues and pull requests: github.com/SeRgi270710267/unwoke-secureblue. Our conduct, not their Covenant. No donate wallet. Useful patches and reproducible bugs beat essays. What the factory already auto-heals vs what must stay a human: Factory.

Maintainer merge only. Fork, PR, wait. pr-gate (job name Strict PR gate) + canary must be green. SeRgi270710267 has the last word (often after a pass with Grok). There is no auto-merge. Green CI is not permission to land. CODEOWNERS is @SeRgi270710267 on every path. GitHub ruleset main-strict requires that PR, one approval, Code Owners, and the gate; it also blocks force-push. The owner can still push main (admin bypass) so the overlay factory does not wait on a second account. Factory bot commits also need GitHub Actions (app 15368) on that bypass list. Workflows, receipt, GHCR, and alarms: Factory → GitHub map.

Hard no

gpgcheck=0, setenforce 0, unsigned rebase as a default, firewall off
New vendor hostname, Flathub/Snap, or a store “to make it work”
Default-off Safe Browsing or fwupd
Secrets / cosign.key in the tree; pull_request_target; auto-merge
Deleting canary needles to pass CI

Every new overlay lock needs a ujust revert. If it weakens a lock, it is opt-in and must warn. Fill the PR template. Use the issue forms (overlay bug vs lock idea). Stock kernel bugs go upstream.

Public mark

Every overlay file under files/ and recipes/ must carry UNWOKE-SHIPPED-FIRST and the MIT copyright line. Compose stamps a forgotten file in the image. Inspect and the PR gate fail if git is still unmarked. Do not put the token into live Chromium/Brave/Trivalent policies/managed JSON. Do not obfuscate. Do not change the license. Do not weaken a lock to “protect credit.” Ledger: Shipped first.

git clone https://github.com/SeRgi270710267/unwoke-secureblue
# recipes/  overlay modules
# files/    scripts, SELinux, policies, just
# docs/     this site (not the mirrored tree)

docs/secureblue/ is generated in CI from their markdown. Do not edit it by hand.

Tell people automatically

Pages rebuilds Home “What’s new”, the Compared ledger, and Changelog highlights from main. You do not edit those tables by hand for ordinary work. Factory-only commits (CI pins, snapshot hashes) stay off the human lists.

If the git subject is not enough, add three lines to the commit body. They become the Compared row:

People: Easy sentence a daily user should read.
Vs: How this is stricter or easier than stock.
Where: Pages now / Next overlay bake / USB ISO

Seed for older history: docs/_tools/people-seed.json. Toggles on Features stay a written spec (wrong automation would lie). Stock GitHub issues that map to a revertable overlay ujust are listed on Workarounds at Pages deploy — never applied to a bake. A free public text model (Pollinations) writes a short Unwoke note unless you set GROQ_API_KEY or XAI_API_KEY. The model cannot invent a command.

Stock secureblue (mirrored)

Their contributing guide — Discord, AI ban, pre-commit, test-build forks of their image recipes — is pulled daily. That process contributes to secureblue, not this overlay.

Their contributing (mirrored)

Canonical: https://secureblue.dev/contributing