Rework README, add contributing guide, Scorecard and coverage

.github/workflows/scorecard.yml

@@ -0,0 +1,46 @@
+# OpenSSF Scorecard supply-chain security analysis, published to https://scorecard.dev for the README badge
+name: Scorecard
+
+on:
+  push:
+    branches: [main]
+  schedule:
+    - cron: '17 4 * * 1'
+  # For the Branch-Protection check to pick up changes to branch protection rules
+  branch_protection_rule:
+  workflow_dispatch:
+
+permissions: {}
+
+jobs:
+  analysis:
+    name: Scorecard analysis
+    runs-on: ubuntu-latest
+    permissions:
+      # Upload results to the code scanning dashboard
+      security-events: write
+      # Publish results to the OpenSSF REST API
+      id-token: write
+      contents: read
+      actions: read
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+      - name: Run analysis
+        uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4
+        with:
+          results_file: results.sarif
+          results_format: sarif
+          publish_results: true
+      - name: Upload artifact
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: scorecard-results
+          path: results.sarif
+          retention-days: 5
+      - name: Upload to code scanning
+        uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
+        with:
+          sarif_file: results.sarif

.github/workflows/test.yml

@@ -6,15 +6,24 @@ on:
   pull_request:
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   linux:
     name: Linux test
     runs-on: ${{ matrix.runs-on }}
+    permissions:
+      contents: read
+      # Codecov upload via OIDC
+      id-token: write
     strategy:
       fail-fast: false
       matrix:
         include:
           - runs-on: ubuntu-24.04
+            coverage: true
+            maven-flags: -Pcoverage
           - runs-on: ubuntu-24.04-arm
             # Azul Zulu 7 not available on Aarch64
             maven-flags: >-
@@ -57,3 +66,13 @@ jobs:
             -Dsurefire.reportFormat=plain \
             ${{ matrix.maven-flags }} \
             verify
+      - name: Upload coverage to Codecov
+        if: matrix.coverage
+        uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7.1.1
+        with:
+          files: target/site/jacoco/jacoco.xml
+          disable_search: true
+          # OIDC tokens are not available to pull requests from other repositories, which use tokenless upload instead.
+          # Don't use head.repo.fork here: this repository is itself a fork, so that is always true.
+          use_oidc: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
+          fail_ci_if_error: false

CHANGES.md

@@ -1,5 +1,8 @@
 # Change log
 
+*This changelog covers lz4-java 1.8.0 and earlier. For newer versions, see
+[GitHub Releases](https://github.com/yawkat/lz4-java/releases).*
+
 ## 1.8.0
 
 - Upgraded LZ4 to 1.9.3. Updated the JNI bindings. Minimum glibc version in GNU/Linux platforms: 2.17 on aarch64, 2.2.5 on amd64, 2.17 on ppc64le, 2.2 on s390x.

CONTRIBUTING.md

@@ -0,0 +1,39 @@
+# Contributing to lz4-java
+
+Thanks for your interest in contributing!
+
+## Reporting bugs and requesting features
+
+- **Bugs and feature requests:** open a [GitHub issue](https://github.com/yawkat/lz4-java/issues). For bugs, include
+  the lz4-java version, Java version, OS and architecture, which `LZ4Factory`/`XXHashFactory` instance you use, and
+  ideally a minimal reproducer.
+- **Questions:** use [GitHub Discussions](https://github.com/yawkat/lz4-java/discussions).
+- **Security vulnerabilities:** do **not** open a public issue. Report them privately through
+  [GitHub's vulnerability reporting](https://github.com/yawkat/lz4-java/security/advisories/new).
+
+## Pull requests
+
+Pull requests are welcome. For larger changes, please open an issue first to discuss the approach.
+
+To be accepted, a contribution must meet these requirements:
+
+- **The build passes.** `./mvnw verify` must succeed, and CI must be green on all platforms. See the
+  [README](README.md#building) for build prerequisites.
+- **Java 7 compatibility.** The library is compiled with Java 7 and must not use newer language features or APIs.
+  Tests may use the newer Java version configured in `pom.xml`.
+- **No breaking API changes.** Public API must stay source and binary compatible. Deprecate instead of removing, and
+  keep new non-user-facing members as private as possible.
+- **Tests.** Bug fixes should come with a regression test, and new features with tests. New tests use JUnit 5 or
+  newer (existing JUnit 4 tests run through the vintage engine). Code that parses input (decompressors, streams)
+  should also be covered by a [Jazzer](https://github.com/CodeIntelligenceTesting/jazzer) fuzz test, run with the
+  `fuzz` Maven profile. Each fuzz test needs its own execution in that profile.
+- **Code style.** There is no automated formatter. Follow the style of the surrounding code and
+  [`.editorconfig`](.editorconfig) (2-space indentation), and keep diffs minimal: no unrelated reformatting.
+- **Generated code.** Most of the Java and Unsafe implementations are generated from the MVEL templates in
+  `src/build/source_templates`. Edit the templates, not the generated files under `target/`.
+- **Implementations stay consistent.** A change to one implementation (JNI, Java safe, Java unsafe) usually needs a
+  matching change in the others.
+- **License.** Contributions are accepted under the [Apache License 2.0](LICENSE.txt), the project's license. New
+  source files need the Apache license header used by existing files.
+
+Keep pull requests focused on a single change and describe what changed and why.