chore: GitHub workflow revamp — GitHub Flow, community files, CI updates (#101)

* chore: add comprehensive .gitignore

* ci: update CI workflow for GitHub Flow

- Change triggers from develop to main (PRs to main + pushes to main)
- Add concurrency controls to cancel stale runs
- Update docker/build-push-action to v6
- Add descriptive job names for branch protection status checks
- Update screenshot refresh and docs sync to trigger on main pushes

* ci: update docker-publish for GitHub Flow

- Remove develop branch trigger (no more dev tag)
- Keep v* tag trigger for releases
- Update docker/build-push-action to v6

* docs: add community and governance files

- CONTRIBUTING.md with dev setup and PR guidelines
- SECURITY.md with vulnerability reporting policy
- CODE_OF_CONDUCT.md (Contributor Covenant v2.1 reference)
- PR template with conventional commits checklist
- Issue templates for bug reports and feature requests
- CODEOWNERS defaulting to @AnsoCode
- Dependabot config for npm (root, backend, frontend) and GitHub Actions

* docs: add README with badges, quick start, and contributing section

* chore: add LICENSE placeholder and open license decision issue (#100)

* docs: update CLAUDE.md for GitHub Flow branching model

- Replace develop-based Git Flow with GitHub Flow (main only)
- All branches now created off main, PRs target main
- Simplify release checklist (no develop-to-main merge step)
- Update testing strategy to reference Vitest and Playwright
- Fix docs.json reference (was mint.json)

* chore: track CLAUDE.md in version control

Remove CLAUDE.md from .gitignore so project workflow instructions
are versioned alongside the code they govern.

* docs: add MANUAL_STEPS.md for GitHub settings that require UI configuration

.github/workflows/ci.yml

@@ -2,12 +2,18 @@ name: Sencho CI
 
 on:
   pull_request:
-    branches: [ main, develop ]
+    branches: [main]
   push:
-    branches: [ develop ]
+    branches: [main]
+
+# Cancel previous runs on the same branch/PR
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
 
 jobs:
   backend:
+    name: Backend (Build, Test, Lint)
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Code
@@ -41,6 +47,7 @@ jobs:
         run: npm audit --audit-level=high
 
   frontend:
+    name: Frontend (Build, Lint)
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Code
@@ -70,6 +77,7 @@ jobs:
         run: npm audit --audit-level=high
 
   docker-validate:
+    name: Docker Build & Scan
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Code
@@ -79,7 +87,7 @@ jobs:
         uses: docker/setup-buildx-action@v3
 
       - name: Build Docker image (validation only)
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@v6
         with:
           context: .
           push: false
@@ -98,8 +106,9 @@ jobs:
         continue-on-error: true
 
   e2e:
+    name: E2E Tests (Playwright)
     runs-on: ubuntu-latest
-    needs: [ backend, frontend ]
+    needs: [backend, frontend]
     steps:
       - name: Checkout Code
         uses: actions/checkout@v4
@@ -163,10 +172,11 @@ jobs:
           retention-days: 7
 
   update-screenshots:
+    name: Refresh Doc Screenshots
     runs-on: ubuntu-latest
-    # Only on develop pushes; skip bot commits to avoid an infinite loop
-    if: "github.event_name == 'push' && github.ref == 'refs/heads/develop' && !contains(github.event.head_commit.message, 'docs: refresh screenshots')"
-    needs: [ backend, frontend ]
+    # Only on main pushes (merged PRs); skip bot commits to avoid infinite loop
+    if: "github.event_name == 'push' && github.ref == 'refs/heads/main' && !contains(github.event.head_commit.message, 'docs: refresh screenshots')"
+    needs: [backend, frontend]
     permissions:
       contents: write
       pull-requests: write
@@ -174,8 +184,6 @@ jobs:
       - name: Checkout Code
         uses: actions/checkout@v4
         with:
-          # PAT required — GITHUB_TOKEN cannot create PRs against a protected
-          # branch. DOCS_REPO_TOKEN is a classic PAT with repo scope.
           token: ${{ secrets.DOCS_REPO_TOKEN }}
 
       - name: Setup Node.js
@@ -234,7 +242,7 @@ jobs:
           branch: chore/refresh-screenshots
           commit-message: "docs: refresh screenshots"
           title: "docs: refresh screenshots"
-          body: "Automated screenshot refresh — generated by the `update-screenshots` CI job on every push to `develop`."
+          body: "Automated screenshot refresh — generated by the `update-screenshots` CI job on push to `main`."
           add-paths: docs/images/
           delete-branch: true
 
@@ -248,8 +256,9 @@ jobs:
             --repo ${{ github.repository }}
 
   sync-docs:
+    name: Sync Docs to sencho-docs
     runs-on: ubuntu-latest
-    if: github.event_name == 'push' && github.ref == 'refs/heads/develop'
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
     steps:
       - name: Checkout Sencho repo
         uses: actions/checkout@v4
@@ -260,8 +269,6 @@ jobs:
         env:
           DOCS_TOKEN: ${{ secrets.DOCS_REPO_TOKEN }}
         run: |
-          # Always start clean so a previous partial/broken checkout can't cause
-          # "not in a git directory" on subsequent steps.
           rm -rf sencho-docs
 
           REMOTE="https://x-access-token:${DOCS_TOKEN}@github.com/AnsoCode/sencho-docs.git"
@@ -278,8 +285,6 @@ jobs:
           fi
 
       - name: Copy /docs into sencho-docs root
-        # --exclude='.git' prevents rsync --delete from wiping the .git
-        # directory that was just cloned/initialized in the previous step.
         run: rsync -av --delete --exclude='.git' sencho/docs/ sencho-docs/
 
       - name: Commit and push to sencho-docs
@@ -288,5 +293,5 @@ jobs:
           git config user.email "docs-bot@sencho.io"
           git config user.name "Sencho Docs Bot"
           git add -A
-          git commit -m "docs: sync from develop@${{ github.sha }}" || echo "No changes to commit"
+          git commit -m "docs: sync from main@${{ github.sha }}" || echo "No changes to commit"
           git push origin HEAD:main

.github/workflows/docker-publish.yml

@@ -2,8 +2,6 @@ name: Build and Publish Docker Image
 
 on:
   push:
-    branches:
-      - develop
     tags:
       - 'v*'
   workflow_dispatch:
@@ -36,14 +34,11 @@ jobs:
         with:
           images: saelix/sencho
           tags: |
-            # If pushing to develop, tag as 'dev'
-            type=raw,value=dev,enable=${{ github.ref == 'refs/heads/develop' }}
-            # If pushing a v* tag, tag as 'latest' and the specific semver version
             type=raw,value=latest,enable=${{ startsWith(github.ref, 'refs/tags/v') }}
             type=semver,pattern={{version}},enable=${{ startsWith(github.ref, 'refs/tags/v') }}
 
       - name: Build and push Docker image
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@v6
         with:
           context: .
           push: true