CONTRIBUTING.md tells a newcomer how to set up, test, and submit a change
A contributor who cannot run the tests sends a patch you have to fix yourself. The three commands that get them from clone to green cost you one paragraph and save every future contributor an hour. A contributor also needs to know what an acceptable change looks like before writing it, and learning in review that a feature needed a test costs the round trip the guide exists to save.
Observable check
CONTRIBUTING.md exists at the repository root, in .github/, or in docs/ on GitHub, or at the repository root on GitLab, and states the setup command, the test command, how to open a pull request or merge request, that a change adding functionality arrives with a test, and which document states what an acceptable contribution must satisfy. That document exists at the path or URL the guide names.
Where this comes from
Last read against these sources on 2026-07-30.
OSPS-GV-03.01, Maturity 1-3: 'While active, the project documentation MUST include an explanation of the contribution process.' The Baseline says project documentation rather than a CONTRIBUTING file; naming the file is this standard's tightening. The two later clauses come from the OpenSSF Best Practices badge Passing criteria. 'test_policy', MUST: 'The project MUST have a general policy (formal or not) that as major new functionality is added to the software produced by the project, tests of that functionality should be added to an automated test suite.' Its sibling 'tests_are_added', MUST, asks for evidence the policy was followed in the most recent major changes. This rule checks the stated policy only, because the contributing guide is the artifact it reads; no rule in this standard checks the evidence half, and adding one would mean scoring a project's merge history. 'contribution_requirements', SHOULD at Passing and MUST at Silver, with met_url_required true: 'The information on how to contribute SHOULD include the requirements for acceptable contributions (e.g., a reference to any required coding standard).' That met_url_required flag is why this rule checks for a named document that resolves rather than for prose about requirements: a URL is observable and a paragraph asserting requirements exist is not. The badge accepts an informal policy stated by word of mouth, which nothing outside the project can read, so requiring the sentence in the file is this standard's tightening.