WaCRM is a template — users are expected to fork and customise their
own deployment, not to send feature work back upstream. The previous
CONTRIBUTING.md read like a standard collaborative-project onboarding
guide and set the wrong expectation.
Reframed docs:
- CONTRIBUTING.md is now "Using WaCRM". Opens with "fork it and make
it yours", covers forking + keeping-in-sync commands, explains
which PRs do tend to land (security, correctness, docs, small
nits) vs. which belong in a fork (new features, stack swaps,
opinionated refactors). Keeps the filename so GitHub's built-in
"Contributing guidelines" link still surfaces it.
- .github/ISSUE_TEMPLATE/feature_request.yml: the intro block now
tells the forker up front that feature requests usually become
"build it in your fork", and describes the narrow cases where an
upstream request is useful.
- .github/ISSUE_TEMPLATE/config.yml: adds a third contact link
pointing at CONTRIBUTING.md so people see the fork-first framing
before filing.
- .github/pull_request_template.md: prepends a heads-up that most
changes belong in the forker's own repo, with a pointer to
CONTRIBUTING.md.
Nothing else in the PR changes — CoC, Dependabot, EditorConfig,
Prettier configs, issue bug_report.yml, and the package.json changes
are orthogonal to the fork-first framing and stay as-is.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Nine paperwork files + one devDep. All support work for a repo that's
about to be public; zero runtime behaviour change.
- CONTRIBUTING.md at root. Dev loop, script reference, PR style, code
style, review process. Short on prose, long on specifics.
- .github/CODE_OF_CONDUCT.md adopts Contributor Covenant 2.1 by
reference (no inlined text). Points reports to the maintainer's
email and GitHub's private flow.
- .github/ISSUE_TEMPLATE/ — structured YAML forms for bug and feature
reports, plus config.yml that disables blank issues and surfaces
the security-disclosure + docs links. The bug form asks for
version, runtime, and logs up front so triage doesn't start with
a round of "where is it running?".
- .github/pull_request_template.md — short checklist; nudges toward
typecheck / lint / build before submit without being long enough
to skip.
- .github/dependabot.yml — weekly npm + github-actions scans,
grouped so Supabase / @types / dev-only patches batch into single
PRs instead of six per week. Next / React / Tailwind / eslint-
config-next are ignored so majors stay manual.
- .editorconfig — LF, UTF-8, 2 spaces, final newline, strip trailing
whitespace (except in Markdown where trailing spaces are line
breaks).
- .prettierrc — single quotes + trailing-comma es5, matches the
plurality quote style in the codebase (336 single vs 236 double
in imports). Tailwind plugin sorts class names.
- .prettierignore — node_modules, build output, lockfile, migrations.
- package.json adds "format" / "format:check" scripts and pins
prettier + prettier-plugin-tailwindcss as devDeps.
- package-lock.json refreshed for the new devDeps.
Important: existing source files are NOT reformatted in this PR. 153
files would change if we ran `npm run format`, which would balloon
the diff and make review impossible. The reformat pass is a separate,
deliberate PR.
Typecheck clean; `npx prettier --check` on the new config files
passes.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Prep work so the repo is ready to be public. None of this is runtime
code; it's the governance a forker expects on day one.
- LICENSE: MIT at repo root. README already claimed MIT; this makes
GitHub actually recognise it and show the license badge.
- .github/SECURITY.md: private disclosure path via GitHub Security
Advisories or email. Spells out scope, safe harbour, and what the
reporter should expect — so a researcher finds it before they try
to file a public issue.
- .env.local.example: fleshed out with the three vars it was missing
— META_APP_SECRET (required, from PR 1), NEXT_PUBLIC_SITE_URL
(recommended), and AUTOMATION_CRON_SECRET (optional). Grouped as
Required / Recommended / Optional with a one-line comment per
entry. Includes the openssl/node generators for the secrets.
- package.json: description, repository, bugs, homepage, keywords,
license, author, engines.node >=20. No runtime impact; feeds npm
registry metadata, GitHub's repo sidebar, and prevents forkers from
silently installing on Node <20 (Next 16's floor).
Typecheck clean; npm install run to refresh the lockfile for the
package.json metadata additions (no dependency changes).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Adds .github/workflows/ci.yml running lint, typecheck, and build on
pull_request + push to main. Node 20 (matches the engines we'll pin
in the metadata PR), npm cache keyed on package-lock.json,
concurrency cancel so force-pushes don't queue runs.
Also adds a `typecheck` script to package.json — `tsc --noEmit`. Next
runs its own typecheck during `build`, but exposing it as a script
means editors and pre-commit hooks can invoke it cheaply, and CI can
surface type errors separately from build errors.
Build passes with dummy env vars (tested locally with .env.local
moved aside); NEXT_PUBLIC_SUPABASE_URL, NEXT_PUBLIC_SUPABASE_ANON_KEY,
and ENCRYPTION_KEY are set to placeholder values inside the workflow.
Lint is wired up but marked continue-on-error for now: the repo has
14 pre-existing errors from React 19's new react-hooks/set-state-in-
effect rule, across 8 files, that are out of scope for this PR. They
still show up in the CI logs so regressions are visible; a follow-up
PR will fix them and drop the non-blocking flag.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Adds a CODEOWNERS file mapping every path to @ArnasDon so GitHub
auto-requests his review on every PR. Pair with a branch-protection
rule on main that requires Code Owner approval to make review
mandatory before merge.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
