docs: CONTRIBUTING guide (#11)

Signed-off-by: Junjie Gao <[email protected]>

CONTRIBUTING.md

@@ -0,0 +1,31 @@
+# Contributing to Ratify Go Library
+
+We're so happy you're here! The Ratify Go library is an open-source library built to abstract the core logic of the Ratify project.
+If you're new to these concepts, check our [documentation](https://ratify.dev/docs/category/concepts) for an introduction.
+
+## Code of Conduct
+
+This project has adopted the [CNCF Code of Conduct](https://github.com/cncf/foundation/blob/master/code-of-conduct.md).
+
+## Getting Started
+There are several ways to contribute to this project. Here are a few ideas to get you started:
+- If you would like to ask a question or open an issue or feature request:
+    - Review existing [issues](https://github.com/ratify-project/ratify-go/issues) and [pull requests (PRs)](https://github.com/ratify-project/ratify-go/pulls) to see if your question has already been answered.
+    - If not, open a new issue or feature request by following the [guide](https://github.com/ratify-project/ratify-go/issues/new).
+
+- If you would like to fix an issue or implement a feature:
+    - Review existing issues and provide feedback or ask for clarification. You may also be able to reach out to maintainers through the Slack channel.
+    - After maintainer approval, you can start working on the issue or feature by following the [contributing guidelines](#contributing-guidelines).
+
+- If you're getting more involved as a community or team member:
+    - Join the Slack channel at https://slack.cncf.io/ and choose the `#ratify` channel to discuss the project and get to know the team.
+    - Attend community meetings to discuss project direction and priorities.
+    - Review and provide feedback on open PRs.
+
+## Contributing Guidelines
+1. Fork this repository and create a new branch.
+2. Develop and test your changes (run `make test`).
+3. Commit with sign off and sign with your GPG key ([instructions here](https://docs.github.com/authentication/managing-commit-signature-verification/signing-commits)) or set up a [SSH key](https://docs.github.com/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key#telling-git-about-your-ssh-key) for signing instead. (run `git commit -s -S`)
+4. Open a PR, ensure the PR name follows the [Conventional Commits](https://www.conventionalcommits.org/) format, and wait for all required status checks to pass.
+5. Address any PR comments; this may take several rounds of review.
+6. Once approved, your PR will be merged by the maintainers.

README.md

@@ -18,6 +18,10 @@ The `ratify-go` library follows [Semantic Versioning](https://semver.org/), wher
 - [Ratify Concepts](https://ratify.dev/docs/category/concepts): Documentation of framework, executor, store, and verifier concepts.
 - [Go Reference](https://pkg.go.dev/github.com/ratify-project/ratify-go@main): Library documentation.
 
+## Contributing
+Thanks for your interest in contributing! There are many ways to contribute to this project. 
+Get started here: [CONTRIBUTING.md](./CONTRIBUTING.md)
+
 ## Code of Conduct
 
 This project has adopted the [CNCF Code of Conduct](https://github.com/cncf/foundation/blob/master/code-of-conduct.md).