Loading SOVA...
Loading SOVA...
Everything you need to contribute to SOVA — from setting up your local environment to submitting your first pull request.
Please read our Code of Conduct before contributing. We are committed to providing a welcoming and inclusive experience for everyone. All contributors are expected to uphold these standards in every interaction.
Clone the repository and install dependencies to get your local development environment ready.
$ git clone https://github.com/securenexus/sova.git
$ cd sova
$ npm install
$ npm run build
$ npm test
npm run devStart watch mode — recompiles on file changes for rapid iteration
npm run test:watchRun tests in watch mode — re-runs affected tests as you edit
npm run lintType-check the entire project with tsc --noEmit
Fork the repository
Create a feature branch (feat/my-feature, fix/parser-bug)
Write tests first (TDD encouraged)
Ensure all 437+ tests pass
Sign every commit with DCO (see below)
Submit PR with clear description
Required for every commit
SOVA uses the Developer Certificate of Origin (DCO) to ensure that every contributor has the right to submit their work under the project license. Every commit in your pull request must include a Signed-off-by line. Commits without a DCO sign-off will be automatically rejected by CI.
Use the -s flag when committing:
$ git commit -s -m "feat: add mylang parser"
This automatically appends the following line to your commit message:
Describe expected vs. actual behavior and include steps to reproduce.
Describe the use case and the problem you want to solve.
Include sample manifest and lock files for the ecosystem you want supported.
Email [email protected] directly. Do NOT use public GitHub issues for security vulnerabilities.
Open a GitHub Discussion for questions, ideas, or general conversation. You can also file an issue for specific bugs or feature requests. Project maintainers are listed in MAINTAINERS.md.