Skip to content

Commit 638de2b

Browse files
Michael van den Bergclaude
authored and
Michael van den Berg
committed
chore: add community health files and repo metadata
- LICENSE (MIT) - CONTRIBUTING.md — dev setup, test and style workflow - SECURITY.md — private disclosure process, scope, design notes - CODE_OF_CONDUCT.md — Contributor Covenant v2.1 - .github/ISSUE_TEMPLATE/{bug_report,feature_request}.md - .github/pull_request_template.md Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
1 parent 7762420 commit 638de2b

7 files changed

Lines changed: 258 additions & 0 deletions

File tree

‎.github/ISSUE_TEMPLATE/bug_report.md‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
---
2+
name: Bug report
3+
about: Something is broken
4+
labels: bug
5+
---
6+
7+
## Describe the bug
8+
A clear description of what the bug is.
9+
10+
## To reproduce
11+
Steps to reproduce the behaviour:
12+
1. ...
13+
2. ...
14+
15+
## Expected behaviour
16+
What you expected to happen.
17+
18+
## Environment
19+
- OS:
20+
- Docker version (`docker --version`):
21+
- GPU / VRAM:
22+
- `EMBEDDING_MODEL`:
23+
- `EMBEDDING_DEVICE`:
24+
25+
## Logs
26+
```
27+
# paste relevant output from: docker compose logs
28+
```

‎.github/ISSUE_TEMPLATE/feature_request.md‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
---
2+
name: Feature request
3+
about: Suggest an idea or improvement
4+
labels: enhancement
5+
---
6+
7+
## Problem / motivation
8+
What problem does this feature solve? Who benefits from it?
9+
10+
## Proposed solution
11+
Describe what you'd like to happen.
12+
13+
## Alternatives considered
14+
Any alternative approaches you've thought about.
15+
16+
## Additional context
17+
Links, references, or screenshots that might help.

‎.github/pull_request_template.md‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
## Summary
2+
<!-- What does this PR do? 1-3 bullet points. -->
3+
-
4+
5+
## Type of change
6+
- [ ] Bug fix
7+
- [ ] New feature
8+
- [ ] Refactor / cleanup
9+
- [ ] Docs / config only
10+
11+
## Test plan
12+
<!-- How was this tested? -->
13+
- [ ] `pytest` passes locally
14+
- [ ] Tested against a running `docker compose up` stack
15+
- [ ] New tests added for new behaviour
16+
17+
## Checklist
18+
- [ ] `ruff check` and `ruff format` pass
19+
- [ ] No secrets or personal data included
20+
- [ ] `docker-compose.override.yml` changes go in the `.example` file only

‎CODE_OF_CONDUCT.md‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
# Contributor Covenant Code of Conduct
2+
3+
## Our Pledge
4+
5+
We as members, contributors, and leaders pledge to make participation in our
6+
community a harassment-free experience for everyone, regardless of age, body
7+
size, visible or invisible disability, ethnicity, sex characteristics, gender
8+
identity and expression, level of experience, education, socio-economic status,
9+
nationality, personal appearance, race, caste, colour, religion, or sexual
10+
identity and orientation.
11+
12+
We pledge to act and interact in ways that contribute to an open, welcoming,
13+
diverse, inclusive, and healthy community.
14+
15+
## Our Standards
16+
17+
Examples of behaviour that contributes to a positive environment:
18+
19+
* Demonstrating empathy and kindness toward other people
20+
* Being respectful of differing opinions, viewpoints, and experiences
21+
* Giving and gracefully accepting constructive feedback
22+
* Accepting responsibility and apologising to those affected by our mistakes
23+
* Focusing on what is best not just for us as individuals, but for the overall
24+
community
25+
26+
Examples of unacceptable behaviour:
27+
28+
* The use of sexualised language or imagery, and sexual attention or advances
29+
* Trolling, insulting or derogatory comments, and personal or political attacks
30+
* Public or private harassment
31+
* Publishing others' private information without explicit permission
32+
* Other conduct which could reasonably be considered inappropriate in a
33+
professional setting
34+
35+
## Enforcement Responsibilities
36+
37+
Project maintainers are responsible for clarifying and enforcing our standards
38+
and will take appropriate and fair corrective action in response to any
39+
behaviour they deem inappropriate, threatening, offensive, or harmful.
40+
41+
## Scope
42+
43+
This Code of Conduct applies within all community spaces, and also applies when
44+
an individual is officially representing the community in public spaces.
45+
46+
## Enforcement
47+
48+
Instances of abusive, harassing, or otherwise unacceptable behaviour may be
49+
reported to the project maintainer via GitHub's private
50+
[Security Advisories](https://github.com/M-vdBerg/GraphRAG/security/advisories/new).
51+
All complaints will be reviewed and investigated promptly and fairly.
52+
53+
## Attribution
54+
55+
This Code of Conduct is adapted from the
56+
[Contributor Covenant](https://www.contributor-covenant.org), version 2.1.

‎CONTRIBUTING.md‎

Lines changed: 70 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
# Contributing to GraphRAG
2+
3+
Thank you for your interest in contributing! This document covers how to get
4+
started, the development workflow, and what to expect from the review process.
5+
6+
## Getting started
7+
8+
1. Fork the repository and clone your fork
9+
2. Copy `.env.example` to `.env` and fill in values
10+
3. Copy `docker-compose.override.yml.example` to `docker-compose.override.yml`
11+
4. Install dev dependencies:
12+
```bash
13+
pip install -e ".[dev]"
14+
```
15+
5. Start the stack:
16+
```bash
17+
docker compose up postgres # just the DB is enough for most work
18+
```
19+
20+
## Running tests
21+
22+
```bash
23+
pytest
24+
```
25+
26+
The test suite does not require a running database — DB-dependent tests are
27+
integration tests and are skipped unless `POSTGRES_PASSWORD` is set and the
28+
database is reachable.
29+
30+
## Code style
31+
32+
This project uses [Ruff](https://docs.astral.sh/ruff/) for linting and
33+
formatting.
34+
35+
```bash
36+
ruff check src/ tests/
37+
ruff format src/ tests/
38+
```
39+
40+
Type annotations are checked with mypy:
41+
42+
```bash
43+
mypy src/
44+
```
45+
46+
CI enforces both on every pull request.
47+
48+
## Submitting changes
49+
50+
1. Create a branch from `main`: `git checkout -b feat/my-feature`
51+
2. Make your changes, add tests where appropriate
52+
3. Run the linter and tests locally before pushing
53+
4. Open a pull request against `main` — fill in the PR template
54+
5. A maintainer will review and merge or request changes
55+
56+
## Reporting bugs
57+
58+
Please use the [bug report issue template](.github/ISSUE_TEMPLATE/bug_report.md).
59+
Include the output of `docker compose logs` and your environment details.
60+
61+
## Suggesting features
62+
63+
Open a [feature request](.github/ISSUE_TEMPLATE/feature_request.md) and
64+
describe the use case before starting implementation work. This avoids effort
65+
on changes that may not align with the project direction.
66+
67+
## Code of Conduct
68+
69+
This project follows the [Contributor Covenant](CODE_OF_CONDUCT.md).
70+
Please be respectful and constructive in all interactions.

‎LICENSE‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
MIT License
2+
3+
Copyright (c) 2026 Michael van den Berg
4+
5+
Permission is hereby granted, free of charge, to any person obtaining a copy
6+
of this software and associated documentation files (the "Software"), to deal
7+
in the Software without restriction, including without limitation the rights
8+
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
9+
copies of the Software, and to permit persons to whom the Software is
10+
furnished to do so, subject to the following conditions:
11+
12+
The above copyright notice and this permission notice shall be included in all
13+
copies or substantial portions of the Software.
14+
15+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16+
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17+
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18+
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19+
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20+
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21+
SOFTWARE.

‎SECURITY.md‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
# Security Policy
2+
3+
## Supported versions
4+
5+
| Version | Supported |
6+
|---------|-----------|
7+
| `main` | ✅ Latest commit |
8+
| Older tags | ❌ No backports |
9+
10+
## Reporting a vulnerability
11+
12+
**Please do not open a public GitHub issue for security vulnerabilities.**
13+
14+
Report security issues privately via GitHub's
15+
[Security Advisories](https://github.com/M-vdBerg/GraphRAG/security/advisories/new)
16+
feature (Repository → Security → Advisories → New draft advisory).
17+
18+
Include:
19+
- A description of the vulnerability and its potential impact
20+
- Steps to reproduce or a proof-of-concept
21+
- Any suggested mitigations you are aware of
22+
23+
You can expect an acknowledgement within **72 hours** and a resolution
24+
timeline within **14 days** for critical issues.
25+
26+
## Scope
27+
28+
Issues in scope:
29+
- SQL / Cypher injection via MCP tool inputs
30+
- Authentication or authorisation bypasses in the MCP server
31+
- Container escape or privilege escalation via the Docker setup
32+
- Credential leakage (e.g. secrets ending up in logs or image layers)
33+
34+
Out of scope:
35+
- Vulnerabilities in upstream dependencies (report those to the respective
36+
project maintainers)
37+
- Issues that require physical access to the host machine
38+
39+
## Security design notes
40+
41+
- All containers run as a non-root user (`appuser`, UID 1001)
42+
- No secrets are committed to the repository — credentials are loaded
43+
exclusively from environment variables / `.env` (gitignored)
44+
- The `internal` Docker network isolates PostgreSQL and the watcher from
45+
external access; only the MCP server is on the `external` network
46+
- MCP tool inputs are validated via Pydantic before reaching the database

0 commit comments

Comments
 (0)