chore: add GitHub community files and CI pipeline

- .github/workflows/ci.yml: TypeScript check + Vitest + build on every PR
- .github/dependabot.yml: weekly npm + Actions updates (minor/patch grouped)
- .github/ISSUE_TEMPLATE/: bug_report, feature_request, config (→ Discussions)
- .github/PULL_REQUEST_TEMPLATE.md: checklist for contributors
- SECURITY.md: responsible disclosure policy via GitHub Advisories
- CONTRIBUTING.md: dev setup, code style, commit conventions

.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,47 @@
+---
+name: "\U0001F41B Bug report"
+about: Something isn't working as expected
+title: "[bug] "
+labels: bug
+assignees: ''
+---
+
+## Describe the bug
+
+A clear description of what the bug is.
+
+## Steps to reproduce
+
+1. Go to '...'
+2. Click on '...'
+3. See error
+
+## Expected behavior
+
+What you expected to happen.
+
+## Actual behavior
+
+What actually happened. Include screenshots if relevant.
+
+## Environment
+
+| Field | Value |
+|---|---|
+| immich-folio version | vX.X.X / commit SHA |
+| Immich version | |
+| Deployment | Docker / manual |
+| Browser | Chrome / Firefox / Safari |
+| OS | |
+
+## `content/gallery.yaml` (redacted)
+
+```yaml
+# Paste a minimal reproduction of your config here (remove any tokens/passwords!)
+```
+
+## Logs
+
+```
+# Paste relevant Docker / console logs here
+```

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,8 @@
+blank_issues_enabled: false
+contact_links:
+  - name: "\U0001F4AC Discussions (Questions & Ideas)"
+    url: https://github.com/ralksta/immich-folio/discussions
+    about: Please use Discussions for general questions and ideas instead of issues.
+  - name: "\U0001F512 Security vulnerability"
+    url: https://github.com/ralksta/immich-folio/security/advisories/new
+    about: Please report security vulnerabilities privately via GitHub's Security Advisories.

.github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,27 @@
+---
+name: "\U0001F4A1 Feature request"
+about: Suggest an idea or improvement
+title: "[feat] "
+labels: enhancement
+assignees: ''
+---
+
+## Summary
+
+A brief description of the feature you'd like to see.
+
+## Problem / motivation
+
+What problem does this solve? Is it connected to a specific workflow?
+
+## Proposed solution
+
+Describe the solution you'd like.
+
+## Alternatives considered
+
+Any alternative approaches you've thought about?
+
+## Additional context
+
+Screenshots, mockups, links to similar implementations, etc.

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,27 @@
+## Summary
+
+<!-- What does this PR do? Reference the issue it closes if applicable. -->
+Closes #
+
+## Type of change
+
+- [ ] 🐛 Bug fix
+- [ ] ✨ New feature
+- [ ] 🎨 Style / visual
+- [ ] ♻️ Refactor
+- [ ] 🔒 Security fix
+- [ ] 📝 Documentation
+- [ ] 🛠️ Build / CI
+
+## Checklist
+
+- [ ] `npm run build` passes locally
+- [ ] `npx tsc --noEmit` passes (0 type errors)
+- [ ] `npx vitest run` passes (all tests green)
+- [ ] No secrets / API keys in diff
+- [ ] Documentation updated if needed (`docs/`, `README.md`)
+- [ ] Screenshots attached if there are visual changes
+
+## Screenshots (if applicable)
+
+<!-- Before / After -->

.github/dependabot.yml

@@ -0,0 +1,42 @@
+version: 2
+
+updates:
+  # npm dependencies
+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "09:00"
+      timezone: "Europe/Berlin"
+    open-pull-requests-limit: 5
+    labels:
+      - "dependencies"
+    groups:
+      # Batch minor/patch Next.js updates together
+      nextjs:
+        patterns:
+          - "next"
+          - "eslint-config-next"
+      # Batch React updates
+      react:
+        patterns:
+          - "react"
+          - "react-dom"
+          - "@types/react*"
+    ignore:
+      # Don't auto-update major versions (review manually)
+      - dependency-name: "*"
+        update-types: ["version-update:semver-major"]
+
+  # GitHub Actions
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "09:00"
+      timezone: "Europe/Berlin"
+    labels:
+      - "dependencies"
+      - "github-actions"

.github/workflows/ci.yml

@@ -0,0 +1,43 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+# Cancel in-progress runs for the same PR / branch
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  ci:
+    name: Type-check & Test
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          cache: 'npm'
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: TypeScript – type check
+        run: npx tsc --noEmit
+
+      - name: Run tests
+        run: npx vitest run
+
+      - name: Build
+        run: npm run build
+        env:
+          # Minimal env vars so Next.js build doesn't bail early on env validation
+          IMMICH_URL: http://localhost:2283
+          IMMICH_API_KEY: placeholder-key-for-ci

CONTRIBUTING.md

@@ -0,0 +1,68 @@
+# Contributing to Immich Folio
+
+Thanks for your interest in contributing! 🎉
+
+## Ways to contribute
+
+- **Bug reports** — [Open a bug report issue](https://github.com/ralksta/immich-folio/issues/new?template=bug_report.md)
+- **Feature requests** — [Open a feature request](https://github.com/ralksta/immich-folio/issues/new?template=feature_request.md)
+- **Pull requests** — see below
+- **Discussions** — [Ask questions or share ideas](https://github.com/ralksta/immich-folio/discussions)
+
+## Development setup
+
+```bash
+# 1. Clone
+git clone https://github.com/ralksta/immich-folio.git
+cd immich-folio
+
+# 2. Install
+npm install
+
+# 3. Configure
+cp content/gallery.example.yaml content/gallery.yaml
+# Edit .env or set IMMICH_URL + IMMICH_API_KEY
+
+# 4. Run
+npm run dev       # http://localhost:3000
+npm run build     # production build check
+```
+
+## Before submitting a PR
+
+```bash
+npx tsc --noEmit   # must be 0 errors
+npx vitest run     # all tests must pass
+npm run build      # build must succeed
+```
+
+## Code style
+
+- **TypeScript** — strict mode, no `any` without justification
+- **Components** — Server Components by default; use `'use client'` only when necessary
+- **CSS** — vanilla CSS variables, no Tailwind, no CSS-in-JS
+- **Naming** — descriptive names, no abbreviations in public APIs
+
+## Commit messages
+
+Use [Conventional Commits](https://www.conventionalcommits.org/):
+
+```
+feat: add new hero style
+fix: correct image aspect ratio on mobile
+security: escape HTML in map popups
+docs: update theming guide
+chore: bump next to 15.x
+```
+
+## Pull Request checklist
+
+- [ ] `npx tsc --noEmit` passes
+- [ ] `npx vitest run` passes
+- [ ] `npm run build` passes
+- [ ] No secrets in the diff
+- [ ] Documentation updated if needed
+
+## License
+
+By contributing, you agree that your contributions will be licensed under the [MIT License](LICENSE).

SECURITY.md

@@ -0,0 +1,44 @@
+# Security Policy
+
+## Supported Versions
+
+Only the latest release on `main` is actively maintained.
+
+| Version | Supported |
+|---|---|
+| `main` (latest) | ✅ |
+| older commits | ❌ |
+
+## Reporting a Vulnerability
+
+**Please do not report security vulnerabilities through public GitHub Issues.**
+
+Instead, use one of these private channels:
+
+- **GitHub Security Advisories** (preferred): [Open a draft advisory](https://github.com/ralksta/immich-folio/security/advisories/new)
+- **Email**: contact the maintainer via the email listed on the GitHub profile
+
+### What to include
+
+- Description of the vulnerability and potential impact
+- Steps to reproduce (minimal reproduction if possible)
+- Affected versions / configurations
+- Any proposed fix or mitigation
+
+### Response timeline
+
+- **Acknowledgement**: within 48 hours
+- **Triage & assessment**: within 7 days
+- **Fix & coordinated disclosure**: within 30 days for critical issues
+
+## Scope
+
+immich-folio acts as a **reverse proxy** in front of your private Immich instance. Security issues in scope include:
+
+- Authentication / session bypass
+- API key / secret leakage
+- XSS vulnerabilities in gallery pages or lightbox
+- Rate-limiting bypass enabling DoS
+- Insecure Docker defaults that expose the Immich backend
+
+Out of scope: vulnerabilities in Immich itself (report those upstream at [immich.app](https://immich.app)).