chore: add open-source repo health baseline

Set up lightweight OSS governance with contributing docs, conduct/security policies, PR template, and CI checks for lint/test/build on master PRs.

Made-with: Cursor

Author: dotsystemsdevs

.github/CODE_OF_CONDUCT.md

@@ -0,0 +1,30 @@
+# Code of Conduct
+
+## Our pledge
+
+We want this project to be welcoming and constructive for everyone.
+
+## Expected behavior
+
+- Be respectful and assume good intent.
+- Give actionable feedback, not personal attacks.
+- Keep discussions focused on the code/product problem.
+- Accept that maintainers may prioritize scope and focus.
+
+## Unacceptable behavior
+
+- Harassment, insults, hate speech, or threats.
+- Bad-faith contributions or spam.
+- Publishing private information without consent.
+
+## Enforcement
+
+Maintainers may remove comments/issues/PRs that violate this code.
+Repeated violations may result in a ban from participation.
+
+## Reporting
+
+If you experience or observe unacceptable behavior, contact:
+
+`dot.systems@proton.me`
+

.github/CONTRIBUTING.md

@@ -0,0 +1,67 @@
+# Contributing
+
+Thanks for helping improve `commitmentissues.dev`.
+
+## Ground rules
+
+- Keep PRs small and focused.
+- One concern per PR (bugfix, feature, docs, or refactor).
+- Preserve the existing product tone and UI style.
+- Do not introduce heavy dependencies unless clearly justified.
+
+## Local setup
+
+```bash
+npm install
+npm run dev
+```
+
+Optional for higher GitHub API limits:
+
+```env
+GITHUB_TOKEN=ghp_yourtoken
+```
+
+## Before opening a PR
+
+Run:
+
+```bash
+npm run lint
+npm test
+```
+
+If you changed runtime behavior, also run:
+
+```bash
+npm run build
+```
+
+## Branch and PR flow
+
+1. Fork repo
+2. Create feature branch (`feat/...`, `fix/...`, `docs/...`, `chore/...`)
+3. Commit with clear message
+4. Open PR to `master`
+
+## Issue hygiene
+
+- Use issue templates when available.
+- Include reproduction steps for bugs.
+- Include acceptance criteria for feature requests.
+
+## Scope expectations
+
+Good first contributions:
+
+- UI polish and micro-interactions
+- Small bug fixes
+- Docs improvements
+- Tests around `src/lib/scoring.ts`
+
+Avoid in first PRs:
+
+- Large rewrites
+- Broad architecture refactors
+- Unrelated cleanup mixed into feature work
+

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,19 @@
+## What changed
+
+- 
+
+## Why
+
+- 
+
+## Checklist
+
+- [ ] I tested my change locally (`npm run lint` and `npm test`)
+- [ ] I kept the scope focused and avoided unrelated refactors
+- [ ] I updated docs/screenshots if behavior or UI changed
+- [ ] I confirmed no secrets are added
+
+## Screenshots (if UI change)
+
+<!-- Add before/after images or a short clip -->
+

.github/SECURITY.md

@@ -0,0 +1,18 @@
+# Security Policy
+
+If you discover a security issue, please do **not** open a public issue.
+
+## Report privately
+
+- Use GitHub security advisories for this repository, or
+- Email: `dot.systems@proton.me`
+
+Please include:
+
+- A clear description of the issue
+- Steps to reproduce
+- Potential impact
+- Suggested fix (if available)
+
+We will acknowledge reports as quickly as possible and work on a fix.
+

.github/workflows/ci.yml

@@ -0,0 +1,34 @@
+name: CI
+
+on:
+  pull_request:
+    branches: [master]
+  push:
+    branches: [master]
+
+jobs:
+  validate:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: npm
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Lint
+        run: npm run lint
+
+      - name: Test
+        run: npm test
+
+      - name: Build
+        run: npm run build
+

README.md

@@ -82,6 +82,12 @@ GITHUB_TOKEN=ghp_yourtoken
 npm test
 ```
 
+## Contributing
+
+- Read `.github/CONTRIBUTING.md` before opening a PR
+- Use the issue templates and PR template
+- CI runs lint, tests, and build on `master` PRs
+
 ## Project structure
 
 ```text