Contributing to RMI 🟢
Branch model
main— protected. Every commit passes CI before landing.wip/*— feature branches. Delete after merge.
Commit convention
Conventional Commits, enforced by commitlint + lefthook:
feat(scanner): add LP age check to honeypot suite
fix(wallet): handle zero-decimals SPL tokens in balance math
docs(api): document x402 payment header on /scan
Never: WIP, fix, temp, oops, debug.
Pre-commit gates (lefthook)
| Gate | Tool |
|---|---|
| Lint + format | ruff |
| Types | mypy (strict) |
| Secrets | gitleaks (custom crypto rules) |
| Security | bandit |
| Tests | pytest with coverage ≥ 70% |
Install hooks once: lefthook install.
Testing standard
- Tests must assert behavior, not existence.
assert resp.status_code == 200alone is rejected in review. - Scanner logic needs fixture-based tests with recorded provider responses (
tests/fixtures/). - Mutation score for scanner paths tracked in
MUTATION_BASELINE.md.
What NOT to contribute
- Detection heuristics, thresholds, or scoring weights scraped from elsewhere.
- Anything that identifies internal infrastructure.
- Vendored third-party trees — add a dependency instead.