nordisk/gunnar

Contributing to Gunnar

Thank you for your interest in Gunnar. This page says how to get the code, how to report a bug, and how to propose a change.

Get the code

Anyone can clone the repository anonymously over SSH. Any SSH key works, and it does not have to be registered:

git clone ssh://anonymous@git.gunnar.rs:2222/nordisk/gunnar.git
cd gunnar
cargo build --release

The main branch is master. The released crates are on crates.io (cargo install gunnar).

Report a bug or ask for a feature

Issues live on gunnar.rs, in the repository nordisk/gunnar. Public reading of the issues is coming. Until then you need an account on https://www.gunnar.rs to file or read an issue: sign up there with a passkey, then open the issue in the console. With the CLI, gunnar forge issue open --repo nordisk/gunnar --title … --body … files a signed issue.

If you cannot sign up, write to gunnar@gunnar.rs.

A good bug report gives:

• the version (gunnar --version) or the commit, and the build features;
• what you did, what you expected, and what happened instead;
• the log lines or the error code Gunnar printed.

Do not report a vulnerability as an issue. Follow SECURITY.md instead.

Propose a change

1. Start from a fresh master, on a branch of your own.
2. Make the change in small commits. Each commit message says what changed and why.
3. Push the branch to a repository of your own on gunnar.rs and open a pull request against master in the console. Contributions come only as pull requests on git.gunnar.rs; patches by e-mail are not taken.
4. A maintainer reviews the change. It is merged with git merge --no-ff when the review and the checks below are green.

Before your first change is merged, you accept the Contributor License Agreement in CLA.md: your first pull request adds one line to CLA-SIGNATURES.md (see below).

Coding rules

• Format the code you change with rustfmt. The settings are in rustfmt.toml. Not every file in the tree is formatted yet, so do not reformat files you do not otherwise change.
• Clippy is clean: cargo clippy --workspace --all-targets -- -D warnings.
• cargo xtask ci is green. It runs the rustfmt check, the clone and lock guards, clippy, the tests, the install checks and the CVE gate (cargo xtask cve). Some steps need the sibling repositories beside the clone; the step says so by name when one is missing.
• Every change comes with a test. A bug fix starts with a failing test. Commit the failing test first (its message starts with RED), then the fix that makes it pass (GREEN). The reviewer runs the test at both commits.
• A new dependency needs a reason in the commit message, and it must pass cargo deny (licences, sources and advisories, see deny.toml).
• Commit messages carry no AI co-author trailers. The forge refuses them.

Dependency updates

renovate.json describes the update policy: Cargo locks, the bench image and the workflow actions, proposed weekly, and advisories at once, with images and actions pinned by digest. No Renovate bot runs on gunnar.rs. The dwarves forge (dwarf's CI) runs a dependency-update job instead: it proposes cargo update changes as branches and runs CI on them, and a person merges them. An advisory that has no fixed release is triaged in deny.toml and in the osv-scanner.toml beside the lock that carries it (xtask/tests/osv_triage.rs keeps the two equal).

Licence of contributions

Gunnar is dual licensed: under the GNU Affero General Public License v3.0 only (AGPL-3.0-only), and under a commercial licence (see COMMERCIAL-LICENSING.md). It is owned jointly by Ignalina ApS and Vetra Automation AB.

Because of the dual licence, every outside contribution needs the Contributor License Agreement (CLA) in CLA.md, version 1.1. It grants Ignalina ApS and Vetra Automation AB a licence to your contribution, including the right to license it under the commercial licence as well as under the AGPL, and a licence to any patent of yours that the contribution necessarily uses. You confirm that the contribution is yours to give. You keep the copyright in your contribution.

To accept the CLA, add one line to CLA-SIGNATURES.md in your first pull request:

- Jane Doe, forge account jdoe, 2026-11-02: I agree to CLA.md version 1.1

This line is the only way to accept the CLA. You accept once; it covers all your contributions. Questions about the CLA: gunnar@gunnar.rs.

Conduct

Be kind and stay on the subject. Criticise code, not people. The full code of conduct is CODE_OF_CONDUCT.md (the Contributor Covenant 2.1); who decides what is in GOVERNANCE.md, and how a release is made is in RELEASING.md.