Add CI for PRs, issue/PR templates, CONTRIBUTING and SECURITY docs

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,51 @@
+name: Bug report
+description: Something isn't working correctly
+labels: [bug]
+body:
+  - type: textarea
+    id: description
+    attributes:
+      label: Description
+      description: What happened? What did you expect instead?
+    validations:
+      required: true
+
+  - type: textarea
+    id: steps
+    attributes:
+      label: Steps to reproduce
+      description: Minimal steps to trigger the bug.
+      placeholder: |
+        1. Open a .fig file with …
+        2. Click on …
+        3. See error
+
+  - type: textarea
+    id: file
+    attributes:
+      label: File
+      description: If the bug involves a specific .fig file, attach it or link to the original Figma file.
+
+  - type: dropdown
+    id: platform
+    attributes:
+      label: Platform
+      options:
+        - Web (app.openpencil.dev)
+        - macOS (Tauri)
+        - Windows (Tauri)
+        - Linux (Tauri)
+    validations:
+      required: true
+
+  - type: input
+    id: browser
+    attributes:
+      label: Browser (web only)
+      placeholder: Chrome 131, Safari 18, Firefox 133
+
+  - type: textarea
+    id: screenshots
+    attributes:
+      label: Screenshots
+      description: If applicable, add screenshots or screen recordings.

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1 @@
+blank_issues_enabled: true

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,23 @@
+name: Feature request
+description: Suggest an improvement or new capability
+labels: [enhancement]
+body:
+  - type: textarea
+    id: description
+    attributes:
+      label: Description
+      description: What would you like to see? How would it work?
+    validations:
+      required: true
+
+  - type: textarea
+    id: use-case
+    attributes:
+      label: Use case
+      description: What problem does this solve? How do you work around it today?
+
+  - type: textarea
+    id: figma-reference
+    attributes:
+      label: Figma reference
+      description: If this exists in Figma, describe how it works there. Screenshots welcome.

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,8 @@
+Fixes #
+
+---
+
+**Checklist:**
+- [ ] `bun run check` passes (lint + typecheck)
+- [ ] Tests added or updated
+- [ ] CHANGELOG.md updated (if user-facing)

.github/workflows/ci.yml

@@ -0,0 +1,41 @@
+name: CI
+
+on:
+  pull_request:
+    branches: [master]
+    paths-ignore:
+      - 'packages/docs/**'
+      - 'openspec/**'
+      - '*.md'
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: oven-sh/setup-bun@v2
+
+      - uses: actions/cache@v4
+        with:
+          path: ~/.bun/install/cache
+          key: bun-${{ runner.os }}-${{ hashFiles('bun.lock') }}
+          restore-keys: bun-${{ runner.os }}-
+
+      - run: bun install --frozen-lockfile
+
+      - name: Lint
+        run: bun run lint
+
+      - name: Typecheck
+        run: bunx tsgo --noEmit
+
+      - name: Unit tests
+        run: bun test tests/engine/
+
+      - name: Copy-paste detection
+        run: bun run test:dupes

CONTRIBUTING.md

@@ -0,0 +1,52 @@
+# Contributing
+
+## Setup
+
+```bash
+git clone https://github.com/open-pencil/open-pencil.git
+cd open-pencil
+bun install
+```
+
+## Development
+
+```bash
+bun run dev          # Vite dev server on localhost:1420
+bun run tauri dev    # Tauri desktop app with hot reload
+```
+
+## Quality checks
+
+Run all of these before submitting a PR:
+
+```bash
+bun run check        # oxlint + typecheck
+bun run format       # oxfmt with import sorting
+bun run test:dupes   # jscpd < 3% duplication
+bun test tests/engine/  # unit tests
+bun run test         # Playwright E2E (requires dev server)
+```
+
+## Project structure
+
+- `packages/core` — scene graph, renderer, layout, codec (zero DOM deps)
+- `packages/cli` — headless CLI for .fig inspection and export
+- `packages/mcp` — MCP server for AI tools (stdio + HTTP)
+- `src/` — Tauri/Vite desktop editor
+
+## Conventions
+
+- Bun runtime, not Node
+- Tailwind 4 for styles, no inline CSS or `<style>` blocks
+- No `any`, no `!` non-null assertions
+- `@/` import alias for app code, relative imports within core
+- Use `crypto.getRandomValues()`, never `Math.random()`
+- Icons via unplugin-icons (`<icon-lucide-*>`)
+
+## Test fixtures
+
+`.fig` fixtures in `tests/fixtures/` are Git LFS. Use `git push --no-verify` to skip the slow LFS pre-push hook unless you changed `.fig` files.
+
+## Commits
+
+Follow the existing style in `git log`. Keep messages concise. Update `CHANGELOG.md` for user-facing changes.

SECURITY.md

@@ -0,0 +1,15 @@
+# Security Policy
+
+## Reporting a vulnerability
+
+If you discover a security vulnerability, please report it privately:
+
+**Email:** security@openpencil.dev
+
+Do not open a public issue. We'll acknowledge within 48 hours and aim to release a fix within 7 days for critical issues.
+
+## MCP server
+
+The MCP HTTP transport (`openpencil-mcp-http`) binds to `127.0.0.1` by default with `eval` disabled, CORS disabled, and file access restricted to the working directory. See [MCP docs](https://openpencil.dev/reference/mcp-tools) for configuration.
+
+The stdio transport (`openpencil-mcp`) is intended for local use only and does not apply these restrictions.