Contribution Guidelines
Whether open-source or internal, Solana repos need clear contribution rules: who reviews program changes, how to propose ADRs, and how this guide accepts article fixes.
Recipe
Quick-reference recipe card - copy-paste ready.
## PR checklist
- [ ] Tests pass (anchor test / LiteSVM)
- [ ] IDL updated if program interface changed
- [ ] ADR linked if architectural
- [ ] Runbook updated if ops changed
- [ ] No secrets in diffWhen to reach for this:
- Publishing GitHub
CONTRIBUTING.md - Onboarding contractors
- Open-source community launch
- Guide correction from reader
Working Example
# CONTRIBUTING.md (excerpt)
## Branches
- `main` protected; require 2 approvals on `programs/`
- Feature: `feat/withdraw-v2`
## Commits
feat(lending): add withdraw_v2 instruction
fix(client): bigint amount parsing
docs(incident): update pause runbook
## Security
security@company.com - do not open public issues for exploits# CODEOWNERS
programs/ @solana-team-leads
docs/runbooks/ @sre-oncall
site/solana/ @docs-maintainersWhat this demonstrates:
- Branch protection aligned to risk
- Conventional commits for release notes
- Private security channel
- CODEOWNERS routing
Deep Dive
Contribution Types
| Change | Reviewers | Extra gates |
|---|---|---|
| Program logic | 2 seniors + security | LiteSVM attacker tests |
| Client only | 1 senior | Simulate smoke |
| Docs guide | 1 maintainer | lint-docs |
| Runbook | Ops owner | Drill optional |
Guide Contributions
- Fix factual errors via PR to
site/solana/ - Match stack versions in manifest.json
- No em dashes; stack footer last line
Gotchas
- Drive-by program PR without context - Reject politely; require RFC link. Fix: CONTRIBUTING template.
- Public exploit issue - Copycat risk. Fix: Security policy prominent.
- Docs without lint - Broken links ship. Fix: CI
lint-docsrequired check. - Unlicensed dependency - Legal risk. Fix:
cargo denylicense allowlist. - Force push to main - Incident waiting to happen. Fix: Branch protection.
Alternatives
| Alternative | Use When | Don't Use When |
|---|---|---|
| Fork + PR only | Open source | Internal monorepo |
| Trunk merge | Solo maintainer | Fund-holding program |
| DCO sign-off | Apache projects | Small internal team |
FAQs
First contribution?
Pick good first issue on client or docs; not program security.
CLA required?
Org policy; open source often yes.
Review SLA?
Document in CONTRIBUTING - e.g. 2 business days first response.
Who merges?
Author cannot merge own program PR; on-call merge for hotfix with IC approval.
Release notes?
From conventional commits on tag; IDL version bump included.
Translate docs?
English first; translate-es pipeline post-launch.
AI-generated PRs?
Human must verify Solana claims; reviewer accountability unchanged.
Deprecation?
ADR + semver + sunset date in CHANGELOG.
Community RFC?
GitHub discussion -> internal triage -> eng RFC if accepted.
Guide page style?
Follow sme-content-article spine; see sibling pages in section.
Related
- Documentation Conventions - where docs live
- Coding & Program Standards - code style
- Audit & Bug-Bounty Program - security intake
Stack versions: This page was written for Agave 4.1.1, Solana CLI 3.0.10, Anchor 0.32.1, anchor-lang 0.32.1, Rust 1.91.1, @solana/kit 7.0.0, Surfpool 0.12.0, and LiteSVM 0.6.x.