> For the complete documentation index, see [llms.txt](https://acf.spomky-labs.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://acf.spomky-labs.com/the-project/contributing.md). # Contributing Everything happens in the main repository, [spomky-labs/access-control-framework](https://github.com/spomky-labs/access-control-framework). The two packages are read-only subtree splits of it, and a pull request opened on one of them is closed automatically. ## Running the tests The quality tools live in a Docker image that [Castor](https://castor.jolicode.com/) fetches for you. Nothing else is needed. ```bash castor qa:install # dependencies castor qa:phpunit # the test suite castor qa:all # every check the CI runs castor qa:prepare-pr # fix what can be fixed, then analyse ``` Individual checks: ```bash castor qa:ecs # coding standards castor qa:rector # automated refactoring, dry run castor qa:phpstan # static analysis, at max level castor qa:deptrac # layer boundaries castor qa:lint # syntax ``` ## What a change is expected to carry **Tests, always.** Including where the area you touched had none. **A test that goes through the real path.** A guard that does not run is the failure this project is built against, and it is silent. It has happened once already: the console guard did not run under `--profile`, because the console hands over a wrapped command carrying no attribute, and every unit test passed because they used a bare command the console never provides. Assert on the result, not on the fact that something was called. **The three shapes, for anything touching the Symfony bridge.** SecurityBundle alone, both bundles, this bundle alone. The first two say the migration is seamless; the third says the destination is reachable, and it is the one that finds what is missing. ## Comments Comments belong on the class, the property or the method, never inside a method body. If an explanation is needed in the middle of a function, move it up rather than leave it there. ## Vocabulary The combining algorithms carry their XACML names, not Symfony's. That divergence is deliberate and documented; please do not "fix" it by mimicry. See [Combining Algorithms](/access-control-in-a-nutshell/combining-algorithms.md). ## Security issues Do not open a public issue for a security problem. The reporting procedure is in [SECURITY.md](https://github.com/spomky-labs/access-control-framework/blob/1.0.x/SECURITY.md). --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://acf.spomky-labs.com/the-project/contributing.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.