> ## Documentation Index
> Fetch the complete documentation index at: https://kowshik-93.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Contributing

> shipflow has no application runtime — contributing is mostly editing text and running one validator.

Full guide: [`CONTRIBUTING.md`](https://github.com/Kowshik4593/shipflow/blob/main/CONTRIBUTING.md)
in the repo. Summary:

## Before opening a PR

```bash theme={null}
npm install
python scripts/validate.py   # 66 checks: frontmatter, MCP JSON, templates, a real install
npm run lint                 # eslint on bin/cli.mjs
npm run lint:md               # markdownlint-cli2 on every *.md
```

All three run again in CI on every PR — running them locally first just saves a round trip.

## Adding or changing a skill

Update `skills/<name>/SKILL.md`, then update the skill table and layout tree in the repo's
`README.md` — `validate.py` fails the PR if a skill directory isn't mentioned there. New templates
go in `templates/` and must be referenced from the skill that uses them.

## Changing the CLI or installer

`bin/cli.mjs` (npx) and `install.sh` (bash) are meant to behave identically. `validate.py` runs
both for real and checks the resulting tree — a behavior drift between them fails CI.

## Security

Found a vulnerability? See
[`SECURITY.md`](https://github.com/Kowshik4593/shipflow/blob/main/SECURITY.md) — please don't open
a public issue for it.

## Release process (maintainer-only)

Bumping `package.json`'s `version` and merging to `main` triggers the publish workflow: validate,
tag, GitHub Release, `npm publish --provenance`. Contributors don't need to think about this.