report-upstreamlisted

# Report upstream The finding comes from this session or from $ARGUMENTS. Nothing leaves the machine until the user has seen the exact text and code and said yes. ## Step 1: Locate upstream Take the repository URL from the package's own metadata, never from a search result: | Ecosystem | Where | |---|---| | RubyGems | `gem specification <name> metadata` (`source_code_uri`), else `gem specification <name> homepage` or `bundle info <name>` | | npm | `npm view <name> repository.url` | | PyPI | `pip show <name>` or the `project.urls` in its metadata | | Cargo | `cargo metadata` `repository` field | | Go | the module path itself | | Homebrew | `brew info --json=v2 <name>`: the repository in `urls.stable.url` or `urls.head.url`, else `homepage` | No metadata, or the URL is not the project's canonical repository: stop and ask. ## Step 2: Is it already reported? `gh issue list --repo <owner/repo> --search "<key words>" --state all` and the same for `gh pr list`. Read the closest matches. An open issue that already describes it means: comment with the reproduction, do not open a second one. A closed one with a fix means: the fix is in a version the project has not picked up, report that instead. ## Step 3: Read the rules From the upstream repository, at its default branch: `CONTRIBUTING.md`, `.github/PULL_REQUEST_TEMPLATE.md`, `.github/ISSUE_TEMPLATE/`, `CODE_OF_CONDUCT.md`, and the section of the README about contributing. Note: issue-first policy, DCO or CLA sign-off, commi