Add common repository files for GitHub best practices (#374)

* Update info in CoC

This updates the contact & reporting info.

* Add info to CONTRIBUTING.md

1) Add warning about being unable to accept AI-generated code.
2) Add more details about the contribution, development, & testing
procedures
3) Point to the Google style guides.

* Add typical SUPPORT.md file

* Add security reporting policy

* Update CONTRIBUTING.md

Co-authored-by: Pavol Juhas <[email protected]>

* Update CONTRIBUTING.md

Remove statements about non-existent tools. At some point in the future, the section on "Development and testing" should be updated to describe what is actually used.

* Update CONTRIBUTING.md

Fix wrong default branch name.

* Remove other uses of "main"

Even though "main" was not being used in the sense of "main branch", it might still be confusing, and it was unnecessary to talk about "main repo" when "repo" is enough.

---------

Co-authored-by: Pavol Juhas <[email protected]>

Author: mhucka

.github/SECURITY.md

@@ -0,0 +1,30 @@
+# Reporting security issues
+
+The recirq developers and community take security bugs in recirq seriously.
+We appreciate your efforts to responsibly disclose your findings, and will make
+every effort to acknowledge your contributions.
+
+Please **do not** use GitHub issues to report security vulnerabilities; GitHub
+issues are public, and doing so could allow someone to exploit the information
+before the problem can be addressed. Instead, please use the GitHub ["Report
+a Vulnerability"](https://github.com/quantumlib/recirq/security/advisories/new)
+interface from the _Security_ tab of the recirq repository.
+
+Please report security issues in third-party modules to the person or team
+maintaining the module rather than the recirq project stewards, unless you
+believe that some action needs to be taken with recirq in order to guard
+against the effects of a security vulnerability in a third-party module.
+
+## Responses to security reports
+
+The project stewards at Google Quantum AI will send a response indicating the
+next steps in handling your report. After the initial reply to your report, the
+project stewards will keep you informed of the progress towards a fix and full
+announcement, and may ask for additional information or guidance.
+
+## Additional points of contact
+
+Please contact the project stewards at Google Quantum AI via email at
+[email protected] if you have questions or other concerns. If
+for any reason you are uncomfortable reaching out to the project stewards,
+please email [email protected].

CODE_OF_CONDUCT.md

@@ -53,29 +53,27 @@ representative at an online or offline event. Representation of a project may be
 further defined and clarified by project maintainers.
 
 This Code of Conduct also applies outside the project spaces when the Project
-Steward has a reasonable belief that an individual's behavior may have a
+Stewards have a reasonable belief that an individual's behavior may have a
 negative impact on the project or its community.
 
 ## Conflict Resolution
 
 We do not believe that all conflict is bad; healthy debate and disagreement
 often yield positive results. However, it is never okay to be disrespectful or
-to engage in behavior that violates the project’s code of conduct.
+to engage in behavior that violates the project’s Code of Conduct.
 
-If you see someone violating the code of conduct, you are encouraged to address
+If you see someone violating the Code of Conduct, you are encouraged to address
 the behavior directly with those involved. Many issues can be resolved quickly
 and easily, and this gives people more control over the outcome of their
 dispute. If you are unable to resolve the matter for any reason, or if the
 behavior is threatening or harassing, report it. We are dedicated to providing
 an environment where participants feel welcome and safe.
 
-Reports should be directed to the Cirq Developers <[email protected]>, the
-Project Stewards for ReCirq. It is the Project Stewards' duty to
-receive and address reported violations of the code of conduct. They will then
-work with a committee consisting of representatives from the Open Source
-Programs Office and the Google Open Source Strategy team. If for any reason you
-are uncomfortable reaching out to the Project Stewards, please email
-[email protected].
+Reports should be directed to [email protected],
+the project stewards at Google Quantum AI. They will then work with a committee
+consisting of representatives from the Open Source Programs Office and the
+Google Open Source Strategy team. If for any reason you are uncomfortable
+reaching out to the Project Stewards, please email [email protected].
 
 We will investigate every complaint, but you may not receive a direct response.
 We will use our discretion in determining when and how to follow up on reported

CONTRIBUTING.md

@@ -1,29 +1,114 @@
-# How to Contribute
+# How to contribute
 
-We'd love to accept your patches and contributions to this project. There are
-just a few small guidelines you need to follow.
+We'd love to accept your patches and contributions to this project. We do have
+some guidelines to follow, covered in this document, but don't be concerned
+about getting everything right the first time! Create a pull request (discussed
+below) and we'll nudge you in the right direction.
 
-## Contributor License Agreement
+## Before you begin
 
-Contributions to this project must be accompanied by a Contributor License
-Agreement (CLA). You (or your employer) retain the copyright to your
-contribution; this simply gives us permission to use and redistribute your
-contributions as part of the project. Head over to
-<https://cla.developers.google.com/> to see your current agreements on file or
-to sign a new one.
+### Sign our Contributor License Agreement
 
-You generally only need to submit a CLA once, so if you've already submitted one
-(even if it was for a different project), you probably don't need to do it
-again.
+Contributions to this project must be accompanied by a [Contributor License
+Agreement](https://cla.developers.google.com/about) (CLA). You (or your
+employer) retain the copyright to your contribution; the CLA simply gives us
+permission to use and redistribute your contributions as part of the project.
+Please visit https://cla.developers.google.com/ to see your current agreements
+on file or to sign a new one. You generally only need to submit a Google CLA
+once, so if you've already submitted one (even if it was for a different
+project), you probably don't need to do it again.
 
-## Code reviews
+> [!WARNING]
+> Please note carefully clauses [#5](https://cla.developers.google.com/about/google-corporate#:~:text=You%20represent%20that%20each%20of%20Your%20Contributions%20is%20Your%20original%20creation)
+> and [#7](https://cla.developers.google.com/about/google-corporate#:~:text=Should%20You%20wish%20to%20submit%20work%20that%20is%20not%20Your%20original%20creation%2C%20You%20may%20submit%20it%20to%20Google%20separately)
+> in the CLA. Any code that you contribute to this project must be **your**
+> original creation. Code generated by artificial intelligence tools **does
+> not** qualify as your original creation.
+
+### Review our community guidelines
+
+We have a [code of conduct](CODE_OF_CONDUCT.md) to make the ReCirq project an open
+and welcoming community environment. Please make sure to read and abide by the
+code of conduct.
+
+## Contribution process
 
 All submissions, including submissions by project members, require review. We
-use GitHub pull requests for this purpose. Consult
-[GitHub Help](https://help.github.com/articles/about-pull-requests/) for more
-information on using pull requests.
+use the tools provided by GitHub for [pull
+requests](https://help.github.com/articles/about-pull-requests/) for this
+purpose. The preferred manner for submitting pull requests is to fork the ReCirq
+[repository](https://github.com/quantumlib/ReCirq), create a [git
+branch](https://git-scm.com/book/en/v2/Git-Branching-Branches-in-a-Nutshell) in
+this fork to do your work, and when ready, create a pull request from this
+branch to the ReCirq repository. The subsections below describe the process
+in more detail.
+
+Please make sure to follow the [Google Style
+Guides](https://google.github.io/styleguide/) in your code, particularly the
+[style guide for Python](https://google.github.io/styleguide/pyguide.html).
+
+### Repository forks
+
+1.  Fork the ReCirq repository (you can use the _Fork_ button in upper right
+    corner of the [repository page](https://github.com/quantumlib/ReCirq)).
+    Forking creates a new GitHub repo at the location
+    `https://github.com/USERNAME/ReCirq`, where `USERNAME` is your GitHub user
+    name.
+
+1.  Clone (using `git clone`) or otherwise download your forked repository to
+    your local computer, so that you have a local copy where you can do your
+    development work using your preferred editor and development tools.
+
+1.  Check out the `master` branch and create a new git branch from `master`:
+
+    ```shell
+    git checkout master -b YOUR_BRANCH_NAME
+    ```
+
+    where `YOUR_BRANCH_NAME` is the name of your new branch.
+
+### Development and testing
+
+Do your work and `git commit` your changes to your branch as needed.
+
+### Pull requests and code reviews
+
+1.  If your local copy has drifted out of sync with the `master` branch of the
+    ReCirq repo, you may need to merge the latest changes into your branch.
+    To do this, first update your local `master` and then merge your local `master`
+    into your branch:
+
+    ```shell
+    # Track the upstream repo (if your local repo hasn't):
+    git remote add upstream https://github.com/quantumlib/ReCirq.git
+
+    # Update your local copy.
+    git fetch upstream
+    git checkout master
+    git merge upstream/master
+    # Merge local master into your branch.
+    git checkout YOUR_BRANCH_NAME
+    git merge master
+    ```
+
+    If git reports conflicts during one or both of these merge processes, you
+    may need to [resolve the merge conflicts](
+    https://docs.github.com/articles/about-merge-conflicts) before continuing.
+
+1.  Finally, push your changes to your fork of the ReCirq repo on GitHub:
+
+    ```shell
+    git push origin YOUR_BRANCH_NAME
+    ```
 
-## Community Guidelines
+1.  Now when you navigate to the ReCirq repository on GitHub
+    (https://github.com/quantumlib/ReCirq), you should see the option to create
+    a new pull request from your forked repository. Alternatively, you can
+    create the pull request by navigating to the "Pull requests" tab near the
+    top of the page, and selecting the appropriate branches.
 
-This project follows
-[Google's Open Source Community Guidelines](https://opensource.google/conduct/).
+1.  A reviewer from the ReCirq team will comment on your code and may ask for
+    changes. You can perform the necessary changes locally, commit them to your
+    branch as usual, and then push changes to your fork on GitHub following the
+    same process as above. When you do that, GitHub will update the code in the
+    pull request automatically.

SUPPORT.md

@@ -0,0 +1,22 @@
+# Support
+
+Thank you for your interest in this project! If you are experiencing problems
+or have questions, the following are some suggestions for how to get help.
+
+> [!NOTE]
+> Before participating in our community, please read our [code of
+> conduct](CODE_OF_CONDUCT.md). By interacting with this repository,
+> organization, or community, you agree to abide by its terms.
+
+## Report an issue or request a feature
+
+To report an issue or request a feature in ReCirq, please first search the
+[issue tracker on GitHub](https://github.com/quantumlib/ReCirq/issues) to
+check if there is already an open issue identical or similar to your bug
+report/feature request. If there is none, go ahead and file a new issue in the
+issue tracker.
+
+## Contact the maintainers
+
+For any questions or concerns not addressed here, please email
+[[email protected]](mailto:[email protected]).