Add GitHub best practices infrastructure

.github/ISSUE_TEMPLATE/bug-report.md

@@ -0,0 +1,34 @@
+---
+name: Bug Report
+about: Report a bug or unexpected behavior
+title: ''
+labels: 'bug'
+assignees: ''
+---
+
+## Description
+<!-- A clear and concise description of the bug -->
+
+
+## Steps to Reproduce
+
+1.
+2.
+3.
+
+## Expected Behavior
+<!-- What you expected to happen -->
+
+
+## Actual Behavior
+<!-- What actually happened -->
+
+
+## Environment
+
+- **OS**: <!-- e.g., Windows 11, macOS 15 -->
+- **App Version**: <!-- e.g., 1.1.0 -->
+- **Install Source**: <!-- Microsoft Store / Mac App Store / GitHub Release -->
+
+## Additional Context
+<!-- Screenshots, logs, or any other relevant information -->

.github/dependabot.yml

@@ -0,0 +1,20 @@
+version: 2
+
+updates:
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: weekly
+    target-branch: master
+    open-pull-requests-limit: 10
+    groups:
+      production:
+        dependency-type: production
+      dev:
+        dependency-type: development
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: monthly
+    target-branch: master

.github/pull_request_template.md

@@ -0,0 +1,9 @@
+## Summary
+
+<!-- Brief description of the changes -->
+
+## Test Plan
+
+- [ ] Ran `npm run lint` with no errors
+- [ ] Ran `npm run test:run` with all tests passing
+- [ ] Tested manually in dev mode (`npm start`)

.github/workflows/ci.yml

@@ -0,0 +1,25 @@
+name: CI
+
+on:
+  push:
+    branches: [master]
+  pull_request:
+    branches: [master]
+
+jobs:
+  lint-and-test:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: npm
+
+      - run: npm ci
+
+      - run: npm run lint
+
+      - run: npm run test:run

.nvmrc

@@ -0,0 +1 @@
+20

CONTRIBUTING.md

@@ -293,11 +293,7 @@ python scripts/add_license_headers.py
    ```bash
    git commit -m "Add feature: your feature description
 
-   Detailed explanation of changes...
-
-   🤖 Generated with [Claude Code](https://claude.com/claude-code)
-
-   Co-Authored-By: Your Name <your-email@example.com>"
+   Detailed explanation of changes..."
    ```
 
 5. **Push to your fork**

SECURITY.md

@@ -0,0 +1,34 @@
+# Security Policy
+
+## Supported Versions
+
+| Version | Supported          |
+| ------- | ------------------ |
+| 1.1.x   | Yes                |
+| < 1.1   | No                 |
+
+## Reporting a Vulnerability
+
+If you discover a security vulnerability in Compose Booster, please report it responsibly.
+
+**Do not open a public issue.**
+
+Instead, use one of these methods:
+
+1. **GitHub Private Vulnerability Reporting** - Use the [Security Advisories](https://github.com/lestephen/compose-booster/security/advisories/new) page to report privately.
+2. **Email** - Send details to the maintainer via the email listed on the [GitHub profile](https://github.com/lestephen).
+
+### What to Include
+
+- Description of the vulnerability
+- Steps to reproduce
+- Potential impact
+- Suggested fix (if any)
+
+### Response Timeline
+
+- **Acknowledgment** within 48 hours
+- **Initial assessment** within 1 week
+- **Fix or mitigation** as soon as practical, depending on severity
+
+We appreciate responsible disclosure and will credit reporters in the release notes (unless you prefer to remain anonymous).

vitest.config.ts

@@ -4,6 +4,7 @@
 //
 // Copyright (c) 2025 Stephen Le
 
+// eslint-disable-next-line import/no-unresolved
 import { defineConfig } from 'vitest/config';
 import path from 'path';