Hi! I'm really happy you want to help out with threatcl. At this early stage, the best way to get started is to Submit an Issue or Submit a PR.
I've been doing most of the work in the dev branch, and this is probably the best place to start looking at making changes.
There are a bunch of _test.go files. To run the test suite:
$ make test
Alternatively, if you want to run go vet instead:
$ make vet
Please send a GitHub Pull Request to threatcl with a clear list of what you've done (read more about pull requests). When you send a pull request, we will love you forever if you include tests as well. We can always use more test coverage. Please follow our coding conventions (below) and make sure all of your commits are atomic (one feature per commit).
Always write a clear log message for your commits. One-line messages are fine for small changes, but bigger changes should look like this:
$ git commit -m "fix: A brief summary of the commit
>
> A paragraph describing what changed and its impact."
All Go code should be formatted according to https://pkg.go.dev/golang.org/x/tools/cmd/goimports. This can be validated by running:
This module is a key dependency of https://github.com/threatcl/threatcl and is
expected to follow go module git tagging. Pushing a vN.N.N tag triggers this
repo's release workflow, which publishes a
GitHub Release with a deterministic source archive, an SPDX SBOM, checksums,
and a signed build-provenance attestation (see docs/SLSA.md).
To release a new version:
- See VERSION_MANAGEMENT for how to bump the version —
the pushed tag must match
version.go, or the release workflow stops before publishing anything - Update the CHANGELOG
- Once the main branch has been merged and updated and all the actions are green, you tag
git tag -s vN.N.N -m 'vN.N.N'(a signed tag — see Signing below)git push --tags- Finally, you'll need to adjust the go.mod in http://github.com/threatcl/threatcl
Commits that land on main and release tags should be cryptographically
signed. The simplest setup uses your existing SSH key (no GPG required):
git config --global gpg.format ssh
git config --global user.signingkey ~/.ssh/id_ed25519.pub
git config --global commit.gpgsign true
git config --global tag.gpgsign true
Then add that key to GitHub as a Signing Key (Settings → SSH and GPG keys →
New SSH key → key type "Signing key"). After that, git tag -s produces signed
tags and your commits show as Verified. See docs/SLSA.md for
how this maps to the SLSA Source track.
This project is licensed under the MIT License. By submitting a pull request, you agree that your contributions are licensed under the same terms.
Thanks, Christian @xntrik Frichot