From 76bd8214651b887e341ed5493720e0359ad84a1f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E9=9B=B6Rei?= <212411920+arcjet-rei@users.noreply.github.com> Date: Tue, 6 Oct 2026 16:40:02 -0400 Subject: [PATCH] docs: mark a new example repository as a published copy Co-Authored-By: Claude Opus 5.5 --- CONTRIBUTING.md | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 9a8f25e..5fa7708 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -130,6 +130,15 @@ Once your example is merged into `main`, you can publish it to its own repositor } ``` +3. **Ask an organization owner to mark the repository as a published copy** + + Publishing overwrites the copy, so its Dependabot alerts repeat this + repository's and a fix made in the copy doesn't last. Vulnerabilities are + tracked and fixed here instead. An organization owner: + - sets the `source_repository` custom property to `arcjet/examples` + - applies the **Derived repo** code security configuration, which turns off + Dependabot alerts + Your example repository is now ready to receive code. Next, follow [Publishing an example](#publishing-an-example-semiautomated). ---