# Contributing to Gunnar
Thank you for your interest in Gunnar. This page says how to get the code, how to report
a bug, and how to propose a change.
## Get the code
Anyone can clone the repository anonymously over SSH. Any SSH key works, and it does
not have to be registered:
```
git clone ssh://anonymous@git.gunnar.rs:2222/nordisk/gunnar.git
cd gunnar
cargo build --release
```
The main branch is `master`. The released crates are on crates.io
(`cargo install gunnar`).
## Report a bug or ask for a feature
Issues live on gunnar.rs, in the repository `nordisk/gunnar`. Public reading of the
issues is coming. Until then you need an account on https://gunnar.rs to file or read an
issue: sign up there with a passkey, then open the issue in the console. With the CLI,
`gunnar forge issue open --repo nordisk/gunnar --title … --body …` files a signed issue.
If you cannot sign up, write to gunnar@gunnar.rs.
A good bug report gives:
- the version (`gunnar --version`) or the commit, and the build features;
- what you did, what you expected, and what happened instead;
- the log lines or the error code Gunnar printed.
**Do not report a vulnerability as an issue.** Follow [SECURITY.md](SECURITY.md) instead.
## Propose a change
1. Start from a fresh `master`, on a branch of your own.
2. Make the change in small commits. Each commit message says what changed and why.
3. Push the branch to a repository of your own on gunnar.rs and open a pull request
against `master` in the console. Contributions come only as pull requests on
git.gunnar.rs; patches by e-mail are not taken.
4. A maintainer reviews the change. It is merged with `git merge --no-ff` when the
review and the checks below are green.
Before your first change is merged, you accept the Contributor License Agreement in
[CLA.md](CLA.md): your first pull request adds one line to
[CLA-SIGNATURES.md](CLA-SIGNATURES.md) (see below).
## Coding rules
- **Format** the code you change with rustfmt. The settings are in `rustfmt.toml`.
Not every file in the tree is formatted yet, so do not reformat files you do not
otherwise change.
- **Clippy is clean**: `cargo clippy --workspace --all-targets -- -D warnings`.
- **`cargo xtask ci` is green.** It runs the rustfmt check, the clone and lock guards,
clippy, the tests, the install checks and the CVE gate (`cargo xtask cve`). Some
steps need the sibling repositories beside the clone; the step says so by name when
one is missing.
- **Every change comes with a test. A bug fix starts with a failing test.** Commit the
failing test first (its message starts with `RED`), then the fix that makes it pass
(`GREEN`). The reviewer runs the test at both commits.
- A new dependency needs a reason in the commit message, and it must pass
`cargo deny` (licences, sources and advisories, see `deny.toml`).
- Commit messages carry no AI co-author trailers. The forge refuses them.
## Licence of contributions
Gunnar is dual licensed: under the GNU Affero General Public License v3.0 only
(AGPL-3.0-only), and under a commercial licence (see `COMMERCIAL-LICENSING.md`). It is
owned jointly by Ignalina ApS and Vetra Automation AB.
Because of the dual licence, **every outside contribution needs the Contributor License
Agreement (CLA) in [CLA.md](CLA.md), version 1.1.** It grants Ignalina ApS and Vetra
Automation AB a licence to your contribution, including the right to license it under the
commercial licence as well as under the AGPL, and a licence to any patent of yours that
the contribution necessarily uses. You confirm that the contribution is yours to give.
You keep the copyright in your contribution.
To accept the CLA, add one line to [CLA-SIGNATURES.md](CLA-SIGNATURES.md) in your first
pull request:
```
- Jane Doe, forge account jdoe, 2026-11-02: I agree to CLA.md version 1.1
```
This line is the only way to accept the CLA. You accept once; it covers all your
contributions. Questions about the CLA: gunnar@gunnar.rs.
## Conduct
Be kind and stay on the subject. Criticise code, not people.