From eb556dfa5b16c99ccd6f029ce766def42f45a00b Mon Sep 17 00:00:00 2001 From: August Vi Date: Sat, 10 Oct 2026 19:09:21 -0700 Subject: [PATCH] Add CONTRIBUTING.md, SECURITY.md and a bug report issue template. --- .github/ISSUE_TEMPLATE/bug_report.yml | 47 ++++++++++++++++++++++++++ .github/ISSUE_TEMPLATE/config.yml | 5 +++ CONTRIBUTING.md | 48 +++++++++++++++++++++++++++ SECURITY.md | 17 ++++++++++ 4 files changed, 117 insertions(+) create mode 100644 .github/ISSUE_TEMPLATE/bug_report.yml create mode 100644 .github/ISSUE_TEMPLATE/config.yml create mode 100644 CONTRIBUTING.md create mode 100644 SECURITY.md diff --git a/.github/ISSUE_TEMPLATE/bug_report.yml b/.github/ISSUE_TEMPLATE/bug_report.yml new file mode 100644 index 0000000..30fa478 --- /dev/null +++ b/.github/ISSUE_TEMPLATE/bug_report.yml @@ -0,0 +1,47 @@ +name: Bug report +description: sqlx does something wrong +labels: [bug] +body: +- type: input + id: versions + attributes: + label: Versions + description: sqlx, Go, the driver and the database, each with its version + placeholder: sqlx v1.4.1, go1.27.2, lib/pq v1.10.9, PostgreSQL 16 + validations: + required: true +- type: textarea + id: query + attributes: + label: The query + description: The SQL you pass to sqlx and the call you make (Get, Select, NamedExec, In, ...) + render: sql + validations: + required: true +- type: textarea + id: destination + attributes: + label: The struct, map or slice + description: The Go type you bind or scan into, with its `db` tags + render: go + validations: + required: true +- type: textarea + id: actual + attributes: + label: What happens + description: The error text, the panic trace or the wrong result + validations: + required: true +- type: textarea + id: expected + attributes: + label: What you expected + validations: + required: true +- type: textarea + id: reproduction + attributes: + label: Minimal reproduction + description: A failing test in the style of sqlx_test.go is ideal + render: go diff --git a/.github/ISSUE_TEMPLATE/config.yml b/.github/ISSUE_TEMPLATE/config.yml new file mode 100644 index 0000000..4f9604e --- /dev/null +++ b/.github/ISSUE_TEMPLATE/config.yml @@ -0,0 +1,5 @@ +blank_issues_enabled: true +contact_links: +- name: Question + url: https://github.com/secondwindoss/sqlx/discussions + about: How do I ... questions go to Discussions, not the issue tracker. diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md new file mode 100644 index 0000000..aa63853 --- /dev/null +++ b/CONTRIBUTING.md @@ -0,0 +1,48 @@ +# Contributing + +Bug reports, fixes, tests and documentation are all welcome. + +## Reporting a bug + +Open an issue with the bug report template. The driver and database +version, the SQL, the struct or map you bind or scan, and what you expected +are what make a report reproducible. A failing test in the style of +`sqlx_test.go` is the best report of all. Questions about how to use sqlx go +to [Discussions](https://github.com/secondwindoss/sqlx/discussions). + +## Making a change + +1. Branch from `master`. +2. Add or update a test. The suite always runs against SQLite and also runs + against Postgres and MySQL when their DSN variables are set: + + docker run -d --name sqlx-pg -e POSTGRES_PASSWORD=sqlx -p 5432:5432 postgres:16 + docker run -d --name sqlx-mysql -e MYSQL_ROOT_PASSWORD=sqlx -e MYSQL_DATABASE=sqlx -p 3306:3306 mysql:8 + export SQLX_POSTGRES_DSN='postgres://postgres:sqlx@localhost:5432/postgres?sslmode=disable' + export SQLX_MYSQL_DSN='root:sqlx@tcp(127.0.0.1:3306)/sqlx' + export SQLX_SQLITE_DSN=/tmp/sqlx.db + make test-race + + The test binary prints `Disabling Postgres tests` or `Disabling MySQL + tests` when it cannot connect; CI fails on either line, so make sure both + databases are reachable before you rely on a local run. +3. Run `make tooling` once, then `make lint fmt vuln-check` before pushing. +4. Open a pull request against `master`. CI runs the lint job and the race + tests on Go 1.23 to stable with all three databases and must be green + before the merge. + +Keep the exported API unchanged within v1 unless the change is purely +additive. The `db` tag rules, the default `NameMapper`, the bind constants and +the output of `Named`, `Rebind` and `In` for existing queries are a +compatibility contract. + +## Importing an upstream pull request + +Pull requests that were opened against upstream `jmoiron/sqlx` are welcome +here. Fetch the pull request head and merge it, so the original commits keep +their authors, then add a line to `CHANGELOG.md` naming the upstream pull +request number and author. + +## Commit messages + +One sentence that says what the change does. diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..51c30a1 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,17 @@ +# Security policy + +## Supported versions + +The latest fork release receives security fixes. Versions up to v1.4.0 are +upstream `jmoiron/sqlx` releases and are not patched here. + +## Reporting a vulnerability + +Report it privately through GitHub at +. Please do not +open a public issue. You will hear back from a maintainer, and the fix and the +advisory are published together once a release is out. + +sqlx passes the query strings you give it to the driver as they are; it does +not validate or escape SQL. A query built from untrusted input is an injection +in the calling code, not in sqlx, and is out of scope.