Thanks for your interest in contributing. MedTracker is primarily a personal portfolio project, so external pull requests are welcome but are reviewed and merged at the maintainer's discretion. Bug reports and small, well-tested PRs are especially appreciated.
See the README for full setup instructions (Node version, environment variables, database migrations, dev server).
- Branch off
mainusing a descriptive prefix:feat/,fix/,chore/,docs/,refactor/,test/. - Commit messages follow Conventional Commits:
feat: …,fix: …,docs: …,chore: …,refactor: …,test: …. - Keep commits scoped and reviewable. Prefer multiple small commits over one large one.
- Fork or branch from
main, then open a PR back intomain. - Make sure CI is green —
npm run check,npm run lint,npm run format:check,npx vitest run, andnpm run buildall pass. - Fill in the PR description with a short summary and a test plan.
- Request review from the maintainer; expect feedback before merge.
- TypeScript strict mode; no
anyescapes without justification. - ESLint clean (
npm run lint) and Prettier formatted (npm run format:check). - Svelte 5 runes only — use
$props(),$state(),$derived(),$effect(). No legacyexport letsyntax. - Server logic lives under
src/lib/server/and is never imported from client code. All DB queries are scoped byuser_id. - Validate every form action input through a Zod schema in
src/lib/utils/validation.ts.
- Add unit tests under
tests/unit/for any new logic, especially pure functions and server modules. - CI runs
npm test(Vitest). Tests that touch the database mock thedbimport — seetests/unit/csv.test.tsfor the pattern. - Critical user flows should have a Playwright spec under
tests/e2e/.
Please open a GitHub issue using the bug report template with reproduction steps, expected vs. actual behaviour, and the affected browser / OS.
Do not open a public issue for security reports. See
SECURITY.md for the private disclosure process.