From b8430fa4581eed5a45dcd682ea59bd655466e1ee Mon Sep 17 00:00:00 2001 From: Simon Hamp Date: Thu, 29 Oct 2026 13:02:02 +0000 Subject: [PATCH] Add /contributing and /security pages The contributing page combines the mobile docs' contributing guide with the desktop repo's CONTRIBUTING.md, so there's one place covering both plus the docs and plugins. The security page lists GitHub's private vulnerability reporting form for each public first-party package. Bifrost, the website and private first-party plugins go to support@nativephp.com. Third-party plugins go to the author's support contact from the plugin directory. Both pages are linked from the footer. Co-Authored-By: Claude Opus 5.5 --- resources/views/components/footer.blade.php | 16 + resources/views/contributing.blade.php | 340 ++++++++++++++++++ resources/views/security.blade.php | 197 ++++++++++ routes/web.php | 2 + .../ContributingAndSecurityPagesTest.php | 140 ++++++++ 5 files changed, 695 insertions(+) create mode 100644 resources/views/contributing.blade.php create mode 100644 resources/views/security.blade.php create mode 100644 tests/Feature/ContributingAndSecurityPagesTest.php diff --git a/resources/views/components/footer.blade.php b/resources/views/components/footer.blade.php index 693456dc0..94d80427b 100644 --- a/resources/views/components/footer.blade.php +++ b/resources/views/components/footer.blade.php @@ -321,6 +321,22 @@ class="inline-block px-px py-1.5 transition duration-300 will-change-transform h @endfeature +
  • + + Contributing + +
    • +
  • + + Security + +
  • + {{-- Hero --}} +
    +
    + {{-- Blurred circle - Decorative --}} + + + {{-- Primary Heading --}} +

    + Contributing to NativePHP +

    + + {{-- Subtitle --}} +

    + Bug fixes, new features, documentation and bug reports all help + make NativePHP better. Thank you for helping out. +

    +
    + + {{-- Divider --}} + + + {{-- Content --}} +
    +

    Where to contribute

    + +

    + NativePHP is split across a few repositories on GitHub. Pick the + one your change belongs to: +

    + +     + +

    How to contribute

    + +
      +
    1. + Fork the repository + to your own GitHub account. +
      2. +
    2. + Clone your fork + locally: + 
      git clone git@github.com:your-username/mobile-air.git
      cd mobile-air
      +
      3. +
    3. + Create a branch + with a name that describes your change: + 
      git checkout -b feature/my-new-feature
      +
      4. +
    4. + Make your changes + and follow the code style of the repository you're working + in. +
      5. +
    5. + Test your changes + to make sure they work as intended and don't break anything + else. +
      6. +
    6. + Commit your changes + with clear messages that explain what changed and why. +
      7. +
    7. + Push your branch + to your fork: + 
      git push origin feature/my-new-feature
      +
      8. +
    8. + Open a pull request + against the + main + branch of the original repository. Describe the change, the + problem it solves and anything a reviewer should know. +
      9. +
    9. + Respond to review. + A maintainer will review your pull request and may ask for + changes. Once it's approved, it gets merged. +
      10. +
    + +

    Pull request guidelines

    + +
      +
    • + Keep each pull request focused. Send unrelated changes as + separate pull requests. +
      • +
    • Write clear, descriptive commit messages.
      • +
    • Include tests for any new functionality.
      • +
    • Make sure all existing tests pass before you submit.
      • +
    • + Update the documentation if your change affects the public + API. +
      • +
    + +

    Code style and tests

    + +

    + Follow the conventions of the code around your change. The + mobile and desktop packages use + Laravel Pint + for formatting, PHPStan for static analysis and Pest for tests. + You can run all three before you push: +

    + + 
    composer qa
    + +

    Each step also has its own command:

    + +
      +
    • composer format
      • +
    • composer analyse
      • +
    • composer test
      • +
    + +

    Reporting bugs

    + +

    + If you find a bug, open an issue on the repository it affects. + The + + mobile + + and + + desktop + + issue trackers are where most reports go. Include as much detail + as you can: +

    + +
      +
    • A clear, descriptive title.
      • +
    • Steps to reproduce the issue.
      • +
    • What you expected to happen and what actually happened.
      • +
    • + Your environment: OS, PHP version, Laravel version and + NativePHP version. +
      • +
    + +

    + Questions and ideas for improvements are welcome as issues too. +

    + +

    Security vulnerabilities

    + +

    + Please + don't + open a public issue for a security vulnerability. See our + security policy + for how to report it privately. +

    + +

    License

    + +

    + By contributing, you agree that your contributions will be + licensed under the same license as the repository you're + contributing to. +

    + +

    Code of Conduct

    + +

    + The NativePHP community is dedicated to providing a welcoming + and inclusive experience for everyone. We expect all + participants to follow these standards. +

    + +

    Our pledge

    + +

    + We as members, contributors, and leaders pledge to make + participation in our community a harassment-free experience for + everyone, regardless of age, body size, visible or invisible + disability, ethnicity, sex characteristics, gender identity and + expression, level of experience, education, socio-economic + status, nationality, personal appearance, race, caste, color, + religion, or sexual identity and orientation. +

    + +

    + We pledge to act and interact in ways that contribute to an + open, welcoming, diverse, inclusive, and healthy community. +

    + +

    Our standards

    + +

    + Examples of behavior that contributes to a positive environment: +

    + +
      +
    • Using welcoming and inclusive language
      • +
    • + Being respectful of differing viewpoints and experiences +
      • +
    • Gracefully accepting constructive criticism
      • +
    • Focusing on what is best for the community
      • +
    • Showing empathy towards other community members
      • +
    + +

    Examples of unacceptable behavior:

    + +
      +
    • + The use of sexualized language or imagery, and sexual + attention or advances of any kind +
      • +
    • + Trolling, insulting or derogatory comments, and personal or + political attacks +
      • +
    • Public or private harassment
      • +
    • + Publishing others' private information without explicit + permission +
      • +
    • + Other conduct which could reasonably be considered + inappropriate in a professional setting +
      • +
    + +

    Enforcement

    + +

    + Instances of abusive, harassing, or otherwise unacceptable + behavior may be reported to the project team at + support@nativephp.com + and will be reviewed and investigated promptly and fairly. +

    + +

    + Project maintainers who do not follow or enforce the Code of + Conduct in good faith may face temporary or permanent + repercussions as determined by other members of the project's + leadership. +

    + +

    + The + + Contributor Covenant + + version 2.1 is the basis for this Code of Conduct. +

    + +

    Thank you

    + +

    + Contributors play a big part in making NativePHP what it is. + Once your pull request is merged, you'll show up in the + repository's list of contributors on GitHub. +

    +
    +
    + diff --git a/resources/views/security.blade.php b/resources/views/security.blade.php new file mode 100644 index 000000000..93e688113 --- /dev/null +++ b/resources/views/security.blade.php @@ -0,0 +1,197 @@ + + {{-- Hero --}} +
    +
    + {{-- Blurred circle - Decorative --}} + + + {{-- Primary Heading --}} +

    + Security Policy +

    + + {{-- Subtitle --}} +

    + How to report a security vulnerability in NativePHP, Bifrost or + a plugin. +

    +
    + + {{-- Divider --}} + + + {{-- Content --}} +
    +
    +

    + Please don't disclose security issues publicly. +

    +

    + Don't open a public issue, pull request or discussion for a + vulnerability. Report it privately using one of the options + below. +

    +
    + +

    + All security vulnerabilities will be promptly addressed. Where + you report one depends on what it affects. +

    + +

    Open source packages

    + +

    + For NativePHP's open source packages, use GitHub's private + Report a vulnerability + form on the package's repository. Only the maintainers can see + what you send, and we can work on a fix with you there before + anything is made public. +

    + + @php + $packageGroups = [ + 'Core' => [ + 'nativephp/mobile' => 'mobile-air', + 'nativephp/desktop' => 'desktop', + ], + 'Mobile plugins' => [ + 'nativephp/mobile-browser' => 'mobile-browser', + 'nativephp/mobile-camera' => 'mobile-camera', + 'nativephp/mobile-clipboard' => 'mobile-clipboard', + 'nativephp/mobile-device' => 'mobile-device', + 'nativephp/mobile-dialog' => 'mobile-dialog', + 'nativephp/mobile-dynamic-notifications' => 'mobile-dynamic-notifications', + 'nativephp/mobile-file' => 'mobile-file', + 'nativephp/mobile-media-player' => 'mobile-media-player', + 'nativephp/mobile-microphone' => 'mobile-microphone', + 'nativephp/mobile-network' => 'mobile-network', + 'nativephp/mobile-ota' => 'mobile-ota', + 'nativephp/mobile-share' => 'mobile-share', + 'nativephp/mobile-system' => 'mobile-system', + 'nativephp/mobile-ui' => 'mobile-ui', + 'nativephp/mobile-vibe' => 'mobile-vibe', + ], + 'Tools and starter kits' => [ + 'nativephp/php-bin' => 'php-bin', + 'nativephp/laravel-cloud-deploy' => 'laravel-cloud-deploy', + 'nativephp/web-ui' => 'web-ui', + 'nativephp/mobile-starter' => 'mobile-starter', + 'nativephp/superstack' => 'superstack', + ], + ]; + @endphp + + @foreach ($packageGroups as $group => $packages) +

    {{ $group }}

    + + + @endforeach + +

    Bifrost, this website and private plugins

    + +

    + Email + support@nativephp.com + about vulnerabilities in + Bifrost + or nativephp.com, and in NativePHP's own plugins that aren't + open source. +

    + +

    Third-party plugins

    + +

    + Plugins made by other developers are maintained by their + authors, so report vulnerabilities in them to the author. Every + plugin's page in the + plugin directory + lists its support contact. +

    + +

    + If you can't reach the author, or you think a plugin is + malicious, use the report form on the plugin's page so the + NativePHP team can step in. +

    + +

    What to include

    + +
      +
    • + The package, service or plugin affected, and its version. +
      • +
    • A description of the vulnerability and its impact.
      • +
    • Steps to reproduce it, or a proof of concept.
      • +
    +
    +
    +     diff --git a/routes/web.php b/routes/web.php index 31872767f..dc254c9ce 100644 --- a/routes/web.php +++ b/routes/web.php @@ -231,6 +231,8 @@ Route::view('privacy-policy', 'privacy-policy')->name('privacy-policy'); Route::view('terms-of-service', 'terms-of-service')->name('terms-of-service'); Route::view('developer-terms', 'developer-terms')->name('developer-terms'); +Route::view('contributing', 'contributing')->name('contributing'); +Route::view('security', 'security')->name('security'); Route::view('partners', 'partners')->name('partners'); Route::view('partners/always-curious', 'partners.always-curious')->name('partners.always-curious'); Route::view('build-my-app', 'build-my-app')->name('build-my-app'); diff --git a/tests/Feature/ContributingAndSecurityPagesTest.php b/tests/Feature/ContributingAndSecurityPagesTest.php new file mode 100644 index 000000000..1ea0de1a6 --- /dev/null +++ b/tests/Feature/ContributingAndSecurityPagesTest.php @@ -0,0 +1,140 @@ +withoutVite() + ->get('/contributing') + ->assertOk() + ->assertSee('Contributing - NativePHP', false) + ->assertSeeInOrder([ + 'Contributing to NativePHP', + 'Where to contribute', + 'How to contribute', + 'Pull request guidelines', + 'Code style and tests', + 'Reporting bugs', + 'Security vulnerabilities', + 'License', + 'Code of Conduct', + ]); + } + + #[Test] + public function the_contributing_page_links_to_each_repository_and_the_security_policy(): void + { + $this + ->withoutVite() + ->get('/contributing') + ->assertOk() + ->assertSee('https://github.com/NativePHP/mobile-air', false) + ->assertSee('https://github.com/NativePHP/desktop', false) + ->assertSee('https://github.com/NativePHP/nativephp.com', false) + ->assertSee('security policy', false); + } + + #[Test] + public function the_security_page_links_to_the_github_vulnerability_form_for_every_public_package(): void + { + $repositories = [ + 'mobile-air', + 'desktop', + 'mobile-browser', + 'mobile-camera', + 'mobile-clipboard', + 'mobile-device', + 'mobile-dialog', + 'mobile-dynamic-notifications', + 'mobile-file', + 'mobile-media-player', + 'mobile-microphone', + 'mobile-network', + 'mobile-ota', + 'mobile-share', + 'mobile-system', + 'mobile-ui', + 'mobile-vibe', + 'php-bin', + 'laravel-cloud-deploy', + 'web-ui', + 'mobile-starter', + 'superstack', + ]; + + $response = $this + ->withoutVite() + ->get('/security') + ->assertOk() + ->assertSee('Security - NativePHP', false) + ->assertSee('Security Policy'); + + foreach ($repositories as $repository) { + $response->assertSee("https://github.com/NativePHP/{$repository}/security/advisories/new", false); + } + + $this->assertSame( + count($repositories), + substr_count($response->getContent(), '/security/advisories/new'), + ); + } + + #[Test] + public function the_security_page_points_the_core_mobile_package_at_its_actual_repository(): void + { + $this + ->withoutVite() + ->get('/security') + ->assertOk() + ->assertSee('nativephp/mobile') + ->assertSee('https://github.com/NativePHP/mobile-air/security/advisories/new', false) + ->assertDontSee('https://github.com/NativePHP/mobile/security/advisories/new', false); + } + + #[Test] + public function the_security_page_sends_private_services_to_support_and_third_party_plugins_to_their_authors(): void + { + $this + ->withoutVite() + ->get('/security') + ->assertOk() + ->assertSeeInOrder([ + 'Bifrost, this website and private plugins', + 'mailto:support@nativephp.com', + 'Third-party plugins', + 'plugin directory', + ], false); + } + + #[Test] + public function the_footer_links_to_the_contributing_and_security_pages(): void + { + $this + ->withoutVite() + ->get('/privacy-policy') + ->assertOk() + ->assertSee('href="'.route('contributing').'"', false) + ->assertSee('href="'.route('security').'"', false); + } +}