From 3fa47f7031c9529faabddb7a17fbad35d2e3e71d Mon Sep 17 00:00:00 2001 From: ralksta Date: Fri, 13 Mar 2026 13:00:19 +0100 Subject: [PATCH] chore: add GitHub community files and CI pipeline MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - .github/workflows/ci.yml: TypeScript check + Vitest + build on every PR - .github/dependabot.yml: weekly npm + Actions updates (minor/patch grouped) - .github/ISSUE_TEMPLATE/: bug_report, feature_request, config (→ Discussions) - .github/PULL_REQUEST_TEMPLATE.md: checklist for contributors - SECURITY.md: responsible disclosure policy via GitHub Advisories - CONTRIBUTING.md: dev setup, code style, commit conventions --- .github/ISSUE_TEMPLATE/bug_report.md | 47 ++++++++++++++++ .github/ISSUE_TEMPLATE/config.yml | 8 +++ .github/ISSUE_TEMPLATE/feature_request.md | 27 +++++++++ .github/PULL_REQUEST_TEMPLATE.md | 27 +++++++++ .github/dependabot.yml | 42 ++++++++++++++ .github/workflows/ci.yml | 43 ++++++++++++++ CONTRIBUTING.md | 68 +++++++++++++++++++++++ SECURITY.md | 44 +++++++++++++++ 8 files changed, 306 insertions(+) create mode 100644 .github/ISSUE_TEMPLATE/bug_report.md create mode 100644 .github/ISSUE_TEMPLATE/config.yml create mode 100644 .github/ISSUE_TEMPLATE/feature_request.md create mode 100644 .github/PULL_REQUEST_TEMPLATE.md create mode 100644 .github/dependabot.yml create mode 100644 .github/workflows/ci.yml create mode 100644 CONTRIBUTING.md create mode 100644 SECURITY.md diff --git a/.github/ISSUE_TEMPLATE/bug_report.md b/.github/ISSUE_TEMPLATE/bug_report.md new file mode 100644 index 0000000..e967662 --- /dev/null +++ b/.github/ISSUE_TEMPLATE/bug_report.md @@ -0,0 +1,47 @@ +--- +name: "\U0001F41B Bug report" +about: Something isn't working as expected +title: "[bug] " +labels: bug +assignees: '' +--- + +## Describe the bug + +A clear description of what the bug is. + +## Steps to reproduce + +1. Go to '...' +2. Click on '...' +3. See error + +## Expected behavior + +What you expected to happen. + +## Actual behavior + +What actually happened. Include screenshots if relevant. + +## Environment + +| Field | Value | +|---|---| +| immich-folio version | vX.X.X / commit SHA | +| Immich version | | +| Deployment | Docker / manual | +| Browser | Chrome / Firefox / Safari | +| OS | | + +## `content/gallery.yaml` (redacted) + +```yaml +# Paste a minimal reproduction of your config here (remove any tokens/passwords!) +``` + +## Logs + +``` +# Paste relevant Docker / console logs here +``` diff --git a/.github/ISSUE_TEMPLATE/config.yml b/.github/ISSUE_TEMPLATE/config.yml new file mode 100644 index 0000000..85463cf --- /dev/null +++ b/.github/ISSUE_TEMPLATE/config.yml @@ -0,0 +1,8 @@ +blank_issues_enabled: false +contact_links: + - name: "\U0001F4AC Discussions (Questions & Ideas)" + url: https://github.com/ralksta/immich-folio/discussions + about: Please use Discussions for general questions and ideas instead of issues. + - name: "\U0001F512 Security vulnerability" + url: https://github.com/ralksta/immich-folio/security/advisories/new + about: Please report security vulnerabilities privately via GitHub's Security Advisories. diff --git a/.github/ISSUE_TEMPLATE/feature_request.md b/.github/ISSUE_TEMPLATE/feature_request.md new file mode 100644 index 0000000..7df036d --- /dev/null +++ b/.github/ISSUE_TEMPLATE/feature_request.md @@ -0,0 +1,27 @@ +--- +name: "\U0001F4A1 Feature request" +about: Suggest an idea or improvement +title: "[feat] " +labels: enhancement +assignees: '' +--- + +## Summary + +A brief description of the feature you'd like to see. + +## Problem / motivation + +What problem does this solve? Is it connected to a specific workflow? + +## Proposed solution + +Describe the solution you'd like. + +## Alternatives considered + +Any alternative approaches you've thought about? + +## Additional context + +Screenshots, mockups, links to similar implementations, etc. diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md new file mode 100644 index 0000000..97acb6f --- /dev/null +++ b/.github/PULL_REQUEST_TEMPLATE.md @@ -0,0 +1,27 @@ +## Summary + + +Closes # + +## Type of change + +- [ ] 🐛 Bug fix +- [ ] ✨ New feature +- [ ] 🎨 Style / visual +- [ ] ♻️ Refactor +- [ ] 🔒 Security fix +- [ ] 📝 Documentation +- [ ] 🛠️ Build / CI + +## Checklist + +- [ ] `npm run build` passes locally +- [ ] `npx tsc --noEmit` passes (0 type errors) +- [ ] `npx vitest run` passes (all tests green) +- [ ] No secrets / API keys in diff +- [ ] Documentation updated if needed (`docs/`, `README.md`) +- [ ] Screenshots attached if there are visual changes + +## Screenshots (if applicable) + + diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..b3fd3e4 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,42 @@ +version: 2 + +updates: + # npm dependencies + - package-ecosystem: "npm" + directory: "/" + schedule: + interval: "weekly" + day: "monday" + time: "09:00" + timezone: "Europe/Berlin" + open-pull-requests-limit: 5 + labels: + - "dependencies" + groups: + # Batch minor/patch Next.js updates together + nextjs: + patterns: + - "next" + - "eslint-config-next" + # Batch React updates + react: + patterns: + - "react" + - "react-dom" + - "@types/react*" + ignore: + # Don't auto-update major versions (review manually) + - dependency-name: "*" + update-types: ["version-update:semver-major"] + + # GitHub Actions + - package-ecosystem: "github-actions" + directory: "/" + schedule: + interval: "weekly" + day: "monday" + time: "09:00" + timezone: "Europe/Berlin" + labels: + - "dependencies" + - "github-actions" diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml new file mode 100644 index 0000000..d8dee55 --- /dev/null +++ b/.github/workflows/ci.yml @@ -0,0 +1,43 @@ +name: CI + +on: + push: + branches: [main] + pull_request: + branches: [main] + +# Cancel in-progress runs for the same PR / branch +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + +jobs: + ci: + name: Type-check & Test + runs-on: ubuntu-latest + timeout-minutes: 10 + + steps: + - uses: actions/checkout@v4 + + - name: Set up Node.js + uses: actions/setup-node@v4 + with: + node-version: '20' + cache: 'npm' + + - name: Install dependencies + run: npm ci + + - name: TypeScript – type check + run: npx tsc --noEmit + + - name: Run tests + run: npx vitest run + + - name: Build + run: npm run build + env: + # Minimal env vars so Next.js build doesn't bail early on env validation + IMMICH_URL: http://localhost:2283 + IMMICH_API_KEY: placeholder-key-for-ci diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md new file mode 100644 index 0000000..2d94243 --- /dev/null +++ b/CONTRIBUTING.md @@ -0,0 +1,68 @@ +# Contributing to Immich Folio + +Thanks for your interest in contributing! 🎉 + +## Ways to contribute + +- **Bug reports** — [Open a bug report issue](https://github.com/ralksta/immich-folio/issues/new?template=bug_report.md) +- **Feature requests** — [Open a feature request](https://github.com/ralksta/immich-folio/issues/new?template=feature_request.md) +- **Pull requests** — see below +- **Discussions** — [Ask questions or share ideas](https://github.com/ralksta/immich-folio/discussions) + +## Development setup + +```bash +# 1. Clone +git clone https://github.com/ralksta/immich-folio.git +cd immich-folio + +# 2. Install +npm install + +# 3. Configure +cp content/gallery.example.yaml content/gallery.yaml +# Edit .env or set IMMICH_URL + IMMICH_API_KEY + +# 4. Run +npm run dev # http://localhost:3000 +npm run build # production build check +``` + +## Before submitting a PR + +```bash +npx tsc --noEmit # must be 0 errors +npx vitest run # all tests must pass +npm run build # build must succeed +``` + +## Code style + +- **TypeScript** — strict mode, no `any` without justification +- **Components** — Server Components by default; use `'use client'` only when necessary +- **CSS** — vanilla CSS variables, no Tailwind, no CSS-in-JS +- **Naming** — descriptive names, no abbreviations in public APIs + +## Commit messages + +Use [Conventional Commits](https://www.conventionalcommits.org/): + +``` +feat: add new hero style +fix: correct image aspect ratio on mobile +security: escape HTML in map popups +docs: update theming guide +chore: bump next to 15.x +``` + +## Pull Request checklist + +- [ ] `npx tsc --noEmit` passes +- [ ] `npx vitest run` passes +- [ ] `npm run build` passes +- [ ] No secrets in the diff +- [ ] Documentation updated if needed + +## License + +By contributing, you agree that your contributions will be licensed under the [MIT License](LICENSE). diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..efe21f5 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,44 @@ +# Security Policy + +## Supported Versions + +Only the latest release on `main` is actively maintained. + +| Version | Supported | +|---|---| +| `main` (latest) | ✅ | +| older commits | ❌ | + +## Reporting a Vulnerability + +**Please do not report security vulnerabilities through public GitHub Issues.** + +Instead, use one of these private channels: + +- **GitHub Security Advisories** (preferred): [Open a draft advisory](https://github.com/ralksta/immich-folio/security/advisories/new) +- **Email**: contact the maintainer via the email listed on the GitHub profile + +### What to include + +- Description of the vulnerability and potential impact +- Steps to reproduce (minimal reproduction if possible) +- Affected versions / configurations +- Any proposed fix or mitigation + +### Response timeline + +- **Acknowledgement**: within 48 hours +- **Triage & assessment**: within 7 days +- **Fix & coordinated disclosure**: within 30 days for critical issues + +## Scope + +immich-folio acts as a **reverse proxy** in front of your private Immich instance. Security issues in scope include: + +- Authentication / session bypass +- API key / secret leakage +- XSS vulnerabilities in gallery pages or lightbox +- Rate-limiting bypass enabling DoS +- Insecure Docker defaults that expose the Immich backend + +Out of scope: vulnerabilities in Immich itself (report those upstream at [immich.app](https://immich.app)).