Skip to main content

Contributor guide

At this time, we are not seeking outside contribution

AI has made writing code easy. The hard part, today, is not writing the code, but reviewing it, making sure quality stays high, and keeping the product coherent. In that light, unfortunately, external code contributions are "donating" the easy part of the job, while creating more of the hard work.

With that said, we are happy to accept small, trivially-verified PRs that fix a problem. However, we ask that you refrain from submitting low-value PRs (e.g. typo fixes) or PRs that are more than a dozen or so lines. Such PRs will be closed with a reference to this guideline.

If you have a big idea you'd like us to consider, feel free to open a feature request about it.

This policy may change in the future as the project matures. Until then, thank you for your understanding.

There are still many ways to help, and they are the ones that help us most:

Security bounty program​

Temporarily on hold

Our security bounty program is paused while we revamp our static analysis methodology around LLMs. We still welcome vulnerability reports at [email protected], but monetary rewards are suspended in the meantime.

We are committed to rewarding white hat hackers who help us by identifying and reporting significant security vulnerabilities.

Eligibility and Rewards: We offer rewards of up to $2,500 for the discovery and reporting of severe security flaws that could potentially impact the integrity, confidentiality, or availability of our services. The reward amount is determined by the severity and impact of the vulnerability.

Reporting Process: To report a vulnerability, please send a detailed description, including steps to reproduce it, to [email protected]. Our team will work with you to assess the report and, if validated, make the necessary fixes.

Guidelines: We ask that you act responsibly, not disclose the vulnerability publicly or to third parties before it is fixed, and give us at least 48 hours to address the issue.

Thank you for helping us keep Windmill secure.

Expanding Windmill's integrations: adding new OAuth providers​

To enhance Windmill's connectivity and integration capabilities, we welcome contributions that add new OAuth providers. This not only broadens the range of services Windmill can interact with but also directly impacts the platform's functionality and user experience.

How to Contribute a New OAuth Provider: Submit a Pull Request: Add your new OAuth provider configuration to the backend/oauth_connect.json file with the following format:

"<name_of_resource_type_for_integration>": {
     "auth_url": "<auth_url>",
     "token_url": "<token_url>",
     "scopes": <the list of default scopes to suggest by default>,
     "extra_params": {
         "<key>": "<val>",
     }
 },

Where extra_params is an escape hatch to deal with OAuth provider that need some extra fields to be passed along to the authorization URL.

You can iterate without requiring a dev setup. The item accepts an extra optional field: connect_config or login_config of type OAuthConfig:

interface OAuthConfig {
    auth_url: string,
    token_url: string,
    userinfo_url?: string,
    scopes?: string[],
    extra_params?: Record<string, string>,
    extra_params_callback?: Record<string, string>,
    req_body_auth?: bool
}

connect_config is used for resources, and login_config for SSO.

Mapping python imports​

Python can automatically infer requirements from imports. However it is not always accurate because import can mismatch with the requirement. To handle this case, there is import map. You can help us and others by adding new entries there and opening PR.

Let's take a look at simple example

1. Find problematic import

import git

def main():
  ...

It will fail with error indicates either git cannot be resolved or git module cannot be imported.

2. Pin it

Use one of the pinning methods to override requirement

import git # pin: GitPython

def main():
  ...

3. Add entry to global map

Navigate to mappings and add new entry to the SHORT_IMPORTS_MAP

pub static SHORT_IMPORTS_MAP: PyMap = phf_map! {
    ...
    "git" => "GitPython",
};

4. Open PR

We appreciate every contribution to Windmill!

Special cases

Sometimes dependencies require to be imported separated by .

Let's take a look at one of those on azure-storage-blob example

import azure.storage.blob # pin: azure-storage-blob

As you can see this entire import needs to be mapped and not just azure part of it.

To finalize map for everyone, add this entry in the mappings. But this time add it to FULL_IMPORTS_MAP

pub static FULL_IMPORTS_MAP: PyMap = phf_map! {
    ...
    "azure.storage.blob" => "azure-storage-blob",
};