[docs] Add security policy, contributing guide and code of conduct (#2086)
Co-authored-by: Aryan Kumar <156166681+aryan5v@users.noreply.github.com>
This commit is contained in:
FV SuperAgent
co-authored by
Aryan Kumar
Aryan Kumar
parent
fcbe895b55
commit
0dc6ce5d0a
@@ -0,0 +1,133 @@
|
||||
# Contributor Covenant Code of Conduct
|
||||
|
||||
## Our Pledge
|
||||
|
||||
We as members, contributors, and leaders pledge to make participation in our
|
||||
community a harassment-free experience for everyone, regardless of age, body
|
||||
size, visible or invisible disability, ethnicity, sex characteristics, gender
|
||||
identity and expression, level of experience, education, socio-economic status,
|
||||
nationality, personal appearance, race, caste, color, religion, or sexual
|
||||
identity and orientation.
|
||||
|
||||
We pledge to act and interact in ways that contribute to an open, welcoming,
|
||||
diverse, inclusive, and healthy community.
|
||||
|
||||
## Our Standards
|
||||
|
||||
Examples of behavior that contributes to a positive environment for our
|
||||
community include:
|
||||
|
||||
* Demonstrating empathy and kindness toward other people
|
||||
* Being respectful of differing opinions, viewpoints, and experiences
|
||||
* Giving and gracefully accepting constructive feedback
|
||||
* Accepting responsibility and apologizing to those affected by our mistakes,
|
||||
and learning from the experience
|
||||
* Focusing on what is best not just for us as individuals, but for the overall
|
||||
community
|
||||
|
||||
Examples of unacceptable behavior include:
|
||||
|
||||
* The use of sexualized language or imagery, and sexual attention or advances of
|
||||
any kind
|
||||
* Trolling, insulting or derogatory comments, and personal or political attacks
|
||||
* Public or private harassment
|
||||
* Publishing others' private information, such as a physical or email address,
|
||||
without their explicit permission
|
||||
* Other conduct which could reasonably be considered inappropriate in a
|
||||
professional setting
|
||||
|
||||
## Enforcement Responsibilities
|
||||
|
||||
Community leaders are responsible for clarifying and enforcing our standards of
|
||||
acceptable behavior and will take appropriate and fair corrective action in
|
||||
response to any behavior that they deem inappropriate, threatening, offensive,
|
||||
or harmful.
|
||||
|
||||
Community leaders have the right and responsibility to remove, edit, or reject
|
||||
comments, commits, code, wiki edits, issues, and other contributions that are
|
||||
not aligned to this Code of Conduct, and will communicate reasons for moderation
|
||||
decisions when appropriate.
|
||||
|
||||
## Scope
|
||||
|
||||
This Code of Conduct applies within all community spaces, and also applies when
|
||||
an individual is officially representing the community in public spaces.
|
||||
Examples of representing our community include using an official e-mail address,
|
||||
posting via an official social media account, or acting as an appointed
|
||||
representative at an online or offline event.
|
||||
|
||||
## Enforcement
|
||||
|
||||
Instances of abusive, harassing, or otherwise unacceptable behavior may be
|
||||
reported to the FastVideo maintainers responsible for enforcement at
|
||||
wlsaidhi@gmail.com. All complaints will be reviewed and investigated promptly
|
||||
and fairly.
|
||||
|
||||
All community leaders are obligated to respect the privacy and security of the
|
||||
reporter of any incident.
|
||||
|
||||
## Enforcement Guidelines
|
||||
|
||||
Community leaders will follow these Community Impact Guidelines in determining
|
||||
the consequences for any action they deem in violation of this Code of Conduct:
|
||||
|
||||
### 1. Correction
|
||||
|
||||
**Community Impact**: Use of inappropriate language or other behavior deemed
|
||||
unprofessional or unwelcome in the community.
|
||||
|
||||
**Consequence**: A private, written warning from community leaders, providing
|
||||
clarity around the nature of the violation and an explanation of why the
|
||||
behavior was inappropriate. A public apology may be requested.
|
||||
|
||||
### 2. Warning
|
||||
|
||||
**Community Impact**: A violation through a single incident or series of
|
||||
actions.
|
||||
|
||||
**Consequence**: A warning with consequences for continued behavior. No
|
||||
interaction with the people involved, including unsolicited interaction with
|
||||
those enforcing the Code of Conduct, for a specified period of time. This
|
||||
includes avoiding interactions in community spaces as well as external channels
|
||||
like social media. Violating these terms may lead to a temporary or permanent
|
||||
ban.
|
||||
|
||||
### 3. Temporary Ban
|
||||
|
||||
**Community Impact**: A serious violation of community standards, including
|
||||
sustained inappropriate behavior.
|
||||
|
||||
**Consequence**: A temporary ban from any sort of interaction or public
|
||||
communication with the community for a specified period of time. No public or
|
||||
private interaction with the people involved, including unsolicited interaction
|
||||
with those enforcing the Code of Conduct, is allowed during this period.
|
||||
Violating these terms may lead to a permanent ban.
|
||||
|
||||
### 4. Permanent Ban
|
||||
|
||||
**Community Impact**: Demonstrating a pattern of violation of community
|
||||
standards, including sustained inappropriate behavior, harassment of an
|
||||
individual, or aggression toward or disparagement of classes of individuals.
|
||||
|
||||
**Consequence**: A permanent ban from any sort of public interaction within the
|
||||
community.
|
||||
|
||||
## Attribution
|
||||
|
||||
This Code of Conduct is adapted from the [Contributor Covenant][homepage],
|
||||
version 2.1, available at
|
||||
[https://www.contributor-covenant.org/version/2/1/code_of_conduct.html][v2.1].
|
||||
|
||||
Community Impact Guidelines were inspired by
|
||||
[Mozilla's code of conduct enforcement ladder][mozilla].
|
||||
|
||||
[homepage]: https://www.contributor-covenant.org
|
||||
[v2.1]: https://www.contributor-covenant.org/version/2/1/code_of_conduct.html
|
||||
[mozilla]: https://github.com/mozilla/diversity
|
||||
|
||||
For answers to common questions about this code of conduct, see the FAQ at
|
||||
[https://www.contributor-covenant.org/faq][faq]. Translations are available at
|
||||
[https://www.contributor-covenant.org/translations][translations].
|
||||
|
||||
[faq]: https://www.contributor-covenant.org/faq
|
||||
[translations]: https://www.contributor-covenant.org/translations
|
||||
@@ -0,0 +1,84 @@
|
||||
# Contributing to FastVideo
|
||||
|
||||
Thanks for helping. FastVideo takes fixes, model ports, performance work, tests
|
||||
and docs. This page covers the common path. The longer guides live in
|
||||
`docs/contributing/`, and the in-scope `AGENTS.md` next to the code lists that
|
||||
area's conventions.
|
||||
|
||||
## What you need
|
||||
|
||||
- Python 3.10 to 3.12, on Linux or WSL.
|
||||
- An NVIDIA GPU for inference and training. Some unit tests run on CPU.
|
||||
- CUDA 12.6 or 13.0 for the CUDA path.
|
||||
- macOS with Apple Silicon only if you are changing the MLX runtime.
|
||||
|
||||
The full checklist is in `docs/getting_started/installation/gpu.md`.
|
||||
|
||||
## Set up a development environment
|
||||
|
||||
```bash
|
||||
curl -LsSf https://astral.sh/uv/install.sh | sh
|
||||
git clone https://github.com/hao-ai-lab/FastVideo.git && cd FastVideo
|
||||
uv venv --python 3.12 --seed
|
||||
source .venv/bin/activate
|
||||
|
||||
# cu130 on CUDA 13
|
||||
UV_TORCH_BACKEND=cu126 uv pip install -e ".[dev]"
|
||||
|
||||
# Optional: FlashAttention builds native kernels
|
||||
uv pip install flash-attn --no-build-isolation -v
|
||||
|
||||
pre-commit install --hook-type pre-commit --hook-type commit-msg
|
||||
```
|
||||
|
||||
Conda works too: `conda create -n fastvideo python=3.12 -y`. Prefer `uv pip`
|
||||
for the install inside the environment. For a container, see
|
||||
`docs/contributing/developer_env/docker.md`.
|
||||
|
||||
## Run the checks
|
||||
|
||||
```bash
|
||||
pre-commit run --all-files # lint, format, types, spelling
|
||||
pytest tests/ # top-level tests
|
||||
pytest fastvideo/tests/ -v # package tests
|
||||
```
|
||||
|
||||
Do not call yapf, ruff, mypy or codespell directly. Pre-commit chains them with
|
||||
the project config and respects the excludes. SSIM and golden-gate tests need a
|
||||
GPU and model weights; `docs/contributing/testing.md` explains how to pick the
|
||||
narrowest one.
|
||||
|
||||
## Open a pull request
|
||||
|
||||
- Title with a bracketed tag such as `[feat]`, `[bugfix]`, `[perf]`,
|
||||
`[refactor]`, `[docs]`, `[ci]`, `[infra]` or `[new-model]`. The full accepted
|
||||
set is in `docs/contributing/pull_requests.md`.
|
||||
- One concern per PR. Describe the problem, the change, how you verified it and
|
||||
the risk.
|
||||
- The full workflow, CI tiers and `/test` commands are in
|
||||
`docs/contributing/pull_requests.md`.
|
||||
|
||||
## Add a model or pipeline
|
||||
|
||||
`docs/contributing/coding_agents.md` walks through a new port with a reference
|
||||
example, the files to touch and the acceptance criteria. Update
|
||||
`docs/inference/support_matrix.md` when you add a model. New model PRs need the
|
||||
serving YAML and a cookbook entry, or a short note on why they do not apply.
|
||||
|
||||
## Where to ask
|
||||
|
||||
- Questions and design ideas: [GitHub
|
||||
Discussions](https://github.com/hao-ai-lab/FastVideo/discussions), in Q&A or
|
||||
Ideas.
|
||||
- Chat: the Slack invite is in the [README](README.md).
|
||||
- Bugs and feature requests: use the issue templates.
|
||||
|
||||
## Code of conduct
|
||||
|
||||
Everyone participating in FastVideo is covered by
|
||||
[CODE_OF_CONDUCT.md](CODE_OF_CONDUCT.md).
|
||||
|
||||
## Security
|
||||
|
||||
Do not report vulnerabilities in public issues. See
|
||||
[SECURITY.md](SECURITY.md).
|
||||
+45
@@ -0,0 +1,45 @@
|
||||
# Security policy
|
||||
|
||||
## Reporting a vulnerability
|
||||
|
||||
Report suspected vulnerabilities privately. Do not open a public issue, and do
|
||||
not post details in Discussions or Slack.
|
||||
|
||||
Email the maintainers at wlsaidhi@gmail.com with the subject
|
||||
`FastVideo security report`.
|
||||
|
||||
Include as much of this as you can:
|
||||
|
||||
- The affected component, with the file, CLI command or server endpoint.
|
||||
- Steps to reproduce, using the smallest example you can give.
|
||||
- The FastVideo version or commit you tested. For a source checkout, run
|
||||
`git rev-parse HEAD` for the commit. Include `python collect_env.py` output for
|
||||
the Python, PyTorch and CUDA versions.
|
||||
- Any proof of concept, logs or screenshots.
|
||||
|
||||
## What we do with a report
|
||||
|
||||
We will acknowledge the report and tell you whether we treat it as a security
|
||||
issue. We cannot promise a fix date. We will keep you updated, coordinate the
|
||||
disclosure with you, and credit you in the release notes unless you prefer
|
||||
otherwise. Please give us time to release a fix before you write about the
|
||||
issue.
|
||||
|
||||
## Supported versions
|
||||
|
||||
We apply security fixes on `main`, and they ship in the next release.
|
||||
|
||||
## Scope
|
||||
|
||||
Reports we care about include:
|
||||
|
||||
- Code execution, path traversal or unsafe deserialization while loading
|
||||
models, preprocessing data or serving requests.
|
||||
- Authentication or authorization bypass in the OpenAI-compatible server or the
|
||||
job runner.
|
||||
- Credentials, tokens or private file contents exposed in logs, generated
|
||||
artifacts or error messages.
|
||||
- Remote code execution or privilege escalation in the kernel build path.
|
||||
|
||||
Crashes, model quality, prompt handling and hardware-specific failures without a
|
||||
security impact are regular bugs. Use the bug report template for those.
|
||||
Reference in New Issue
Block a user