Enhancement: Add PR template with security and performance checklists

.github/pull_request_template.md

@@ -0,0 +1,31 @@
+## Summary
+<!-- Describe your changes in detail here -->
+
+## Type of Change
+- [ ] Bug fix (non-breaking change which fixes an issue)
+- [ ] New feature (non-breaking change which adds functionality)
+- [ ] Breaking change (fix or feature that would cause existing functionality to not work as expected)
+- [ ] Chore / Refactor (no functional changes)
+
+## Testing Done
+- [ ] Unit Tests
+- [ ] Integration Tests
+- [ ] Manual Verification (e.g., iOS/Android UI checks)
+
+## Security Considerations
+- [ ] Does this store user data securely (e.g., avoiding plain AsyncStorage for sensitive data)?
+- [ ] Is token handling secure (no token exposure in logs or UI)?
+- [ ] Are all user inputs validated?
+- [ ] Is deep link handling safe from malicious payloads?
+
+## Performance Considerations
+- [ ] Are React hooks (`useCallback`, `useMemo`) used appropriately to prevent unnecessary renders?
+- [ ] Is `FlatList` optimized (e.g., using `getItemLayout`, `keyExtractor`)?
+- [ ] Are asynchronous patterns handled correctly (e.g., `useEffect` cleanup to avoid memory leaks)?
+- [ ] Have bundle size impacts been considered?
+
+## Checklist
+- [ ] I have read the [CONTRIBUTING](CONTRIBUTING.md) guide.
+- [ ] My code follows the style guidelines of this project.
+- [ ] I have updated the documentation accordingly.
+- [ ] Are there architectural changes? If so, is there an Architectural Decision Record (ADR)?

CONTRIBUTING.md

@@ -4,24 +4,35 @@ Thank you for contributing to TeachLink Mobile!
 
 ## Pull Request Guidelines
 
-Before submitting a Pull Request, please ensure that your changes pass all local lint and type checks. 
+When submitting a Pull Request, you must fill out the provided PR template.  
+The template ensures that all necessary considerations are accounted for before merge.
+
+Please review the `.github/pull_request_template.md` which includes:
+- **Summary & Type of Change**: Describe what the PR does.
+- **Testing Done**: List the tests performed.
+- **Security Considerations**: Address concerns like secure data storage, token handling, input validation, and deep link handling.
+- **Performance Considerations**: Address concerns like hook optimization (`useCallback`, `useMemo`), `FlatList` optimization, and asynchronous patterns.
+- **Checklist**: General checks, including checking whether an Architectural Decision Record (ADR) is needed.
+
+## Fast-Fail Syntax Gate
 
-### Fast-Fail Syntax Gate
 We have a dedicated **Syntax Gate** workflow (`.github/workflows/syntax.yml`) that runs on every pull request `opened` or `synchronize` event.
-- This gate checks TypeScript compiler errors (`tsc --noEmit`) and code style rules (`eslint --max-warnings=0`).
-- It is optimized to complete in **under 90 seconds** using a warm cache.
-- The syntax check is a **required check** for branch protection. Pull requests cannot be merged if it fails.
-- To avoid CI failures, you should run linting and type checking locally before pushing.
 
-### Local Quality Checks
+- Checks TypeScript compiler errors (`tsc --noEmit`) and ESLint (`eslint --max-warnings=0`)
+- Optimized to complete in **under 90 seconds** using caching
+- Required for branch protection — PRs cannot be merged if it fails
+- Run checks locally before pushing to avoid CI failures
+
+## Local Quality Checks
+
 You can run the checks locally:
+
 ```bash
 # Run ESLint linting
 npm run lint
 
-# Run Prettier format check
+# Check formatting
 npm run format:check
 
 # Run TypeScript type check
 npx tsc --noEmit
-```