Contributing

Small reproductions, documentation corrections, portability fixes, and fixture-backed codec work are welcome. Follow the code of conduct and report vulnerabilities through security.

Start with maturity, architecture, and the command reference. Discuss large API or dependency changes in an issue before implementing them.

Prepare and verify

make help
make build
make verify
make fmt
make lint

For documentation-only changes, also run make docs-setup, make docs-test docs-lint, and make docs-build. For codec or feature changes, run make test and the matching source-bound coverage flow. JPEG performance changes require the complete benchmark matrix.

Implementation rules

Keep runtime code safe Rust and codec-only. Do not add public image editing, native fallback libraries, or unsafe exceptions. Use the existing bytemuck/wide feature policy and explain any proposed new dependency. Gate each format and keep algorithms under its private codec module.

Preserve structured failures and the earliest meaningful error cause. A mode, palette, frame, policy, or error-path change needs a corresponding complete public manifest input. Diagnose the first C/Pillow-versus-Rust divergence before changing arithmetic or output handling.

Never remove a failing input, change expected output, or weaken a threshold to obtain a pass. Generated outputs remain reproducible evidence and some are required by clean CI checkouts. Follow the fixture provenance and generator instructions before changing them.

Pull requests

Explain the observable problem, resulting behavior, exact case IDs, commands run, results, and remaining limits. Record subtle reference behavior beside the implementation. Retain authorship and license notices for translated code.

Keep public guides current in the same change. Superseded session diaries belong in Git history. Package releases use the separate maintainer process.

Workflow validation

Run make workflows-check before changing GitHub Actions. This validates all workflow YAML, expressions, action inputs, and job dependencies with actionlint 1.7.12; its archive is checksum-verified and cached under target/. The first run downloads the tool. Shell and Python lint remain separate checks. CI runs this gate on every commit. Benchmark harness/workflow changes on main also run the benchmark immediately, in addition to the weekly and manual triggers.

Dependency updates

Dependabot groups Rust updates across the library and JPEG benchmark manifests. Both lockfiles must use the reviewed dependency versions so benchmarks measure the same dependency implementation as the library tests. For a manual update, run make dependency-update DEPENDENCY=wide DEPENDENCY_VERSION=1.7.0 with the reviewed package and version, then make ci-quality supply-chain coverage. Review both lockfile diffs; Cargo may also update dependencies required by that package. Keep GitHub Actions pinned to full commit SHAs with matching release version comments. Validate their release notes and run make workflows-check after updates.