Agent Wranglers

OSS-44Recommended

Send fixes to the projects you depend on

Write down who may contribute to outside open source projects on the company's behalf, and under which licence and sign-off. Every local patch to a dependency links to the upstream issue or pull request that would make it unnecessary.

How to do it

A patch kept only in your own tree must be carried by hand through every upgrade. It breaks on the day upstream changes the same lines. Sending it back removes that cost and helps the project you rely on. The policy says which projects need no approval and who checks for secrets and customer code before a change leaves. It also says whether staff sign contributor agreements. Patch tools such as patch-package or a patches/ folder hold the local copy until the fix is released. Contributions follow the project's own rules, such as Record each contributor's right to submit.

Examples

JavaScript example

import { readFileSync, readdirSync } from 'node:fs';
const missing = readdirSync('patches').filter(file => !/^Upstream: https:\/\/\S+/m.test(readFileSync(`patches/${file}`, 'utf8')));
missing.forEach(file => console.log(`FAIL patches/${file} has no Upstream link`));
process.exit(missing.length ? 1 : 0);

Python example

import pathlib, re, sys
missing = [p.name for p in pathlib.Path("patches").iterdir()
           if not re.search(r"^Upstream: https://\S+", p.read_text(), re.M)]
for name in missing:
    print(f"FAIL patches/{name} has no Upstream link")
sys.exit(1 if missing else 0)

How to check

The policy file exists and names an approver. A script finds every file in patches/ and fails when one has no Upstream: line with a link to an issue or pull request.

For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/open-source/using-open-source/upstream-contributions">Agent Wranglers open source maintenance playbook</a>. In code you write, add a comment next to it with the same link.