ci: add CI workflow, dependabot, npm ci, templates

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,82 @@
+name: Bug report
+description: Report a problem with IStart-Note-AI
+labels: ["bug"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for taking the time to file a report. Please fill in as much as you can.
+        For security issues, follow [SECURITY.md](https://github.com/yan-istart/IStart-Note-AI-Plugin/blob/main/SECURITY.md) instead.
+
+  - type: input
+    id: plugin-version
+    attributes:
+      label: Plugin version
+      placeholder: "e.g. 1.8.3"
+    validations:
+      required: true
+
+  - type: input
+    id: obsidian-version
+    attributes:
+      label: Obsidian version
+      placeholder: "e.g. 1.7.2"
+    validations:
+      required: true
+
+  - type: dropdown
+    id: platform
+    attributes:
+      label: Platform
+      options:
+        - macOS desktop
+        - Windows desktop
+        - Linux desktop
+        - iOS mobile
+        - Android mobile
+    validations:
+      required: true
+
+  - type: textarea
+    id: what-happened
+    attributes:
+      label: What happened?
+      description: A clear and concise description of the bug.
+    validations:
+      required: true
+
+  - type: textarea
+    id: reproduce
+    attributes:
+      label: Steps to reproduce
+      description: How can someone else reproduce the bug?
+      placeholder: |
+        1. Open vault ...
+        2. Right-click ...
+        3. ...
+    validations:
+      required: true
+
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected behavior
+    validations:
+      required: false
+
+  - type: textarea
+    id: console
+    attributes:
+      label: Console output
+      description: Output from the developer console (Ctrl/Cmd+Shift+I → Console). Redact API keys.
+      render: shell
+    validations:
+      required: false
+
+  - type: textarea
+    id: extra
+    attributes:
+      label: Additional context
+      description: Settings, screenshots, related notes (with sensitive content removed).
+    validations:
+      required: false

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,8 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Security report
+    url: https://github.com/yan-istart/IStart-Note-AI-Plugin/security/advisories/new
+    about: Please report security issues privately, not via public issues.
+  - name: Question or discussion
+    url: https://github.com/yan-istart/IStart-Note-AI-Plugin/discussions
+    about: Ask a question or discuss an idea before filing a feature request.

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,33 @@
+name: Feature request
+description: Suggest an idea for IStart-Note-AI
+labels: ["enhancement"]
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: What problem are you trying to solve?
+      description: Describe the workflow you can't accomplish today, not the solution.
+    validations:
+      required: true
+
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposed solution
+      description: What would the feature look like? Mockups and examples are welcome.
+    validations:
+      required: false
+
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives considered
+    validations:
+      required: false
+
+  - type: textarea
+    id: extra
+    attributes:
+      label: Additional context
+    validations:
+      required: false

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,31 @@
+<!-- Thanks for the PR. Please fill in the sections that apply. -->
+
+## Summary
+
+<!-- What does this PR change, in one or two sentences? -->
+
+## Why
+
+<!-- Link an issue if there is one, or describe the motivation. -->
+
+## How was it tested?
+
+<!-- Manual test steps, or commands run. -->
+
+- [ ] `npm run typecheck` passes
+- [ ] `npm run build` passes
+- [ ] Tested manually in Obsidian
+
+## User-facing impact
+
+<!--
+Mark "none" for refactors / internal changes.
+For changes that affect vault contents (frontmatter, paths, sync layout), describe migration impact and add a note to CHANGELOG.md.
+-->
+
+## Checklist
+
+- [ ] PR is focused on a single change
+- [ ] Updated `CHANGELOG.md` under "Unreleased" if user-visible
+- [ ] Updated `README.md` / `README.zh-CN.md` if behavior or setup changed
+- [ ] No new direct `requestUrl` calls to LLM endpoints (use `core/llm` instead)

.github/dependabot.yml

@@ -0,0 +1,25 @@
+version: 2
+updates:
+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5
+    labels:
+      - "dependencies"
+    groups:
+      typescript:
+        patterns:
+          - "typescript"
+          - "@typescript-eslint/*"
+      esbuild:
+        patterns:
+          - "esbuild"
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "monthly"
+    labels:
+      - "dependencies"
+      - "ci"

.github/workflows/ci.yml

@@ -0,0 +1,35 @@
+name: CI
+
+on:
+  push:
+    branches: [main, master]
+  pull_request:
+    branches: [main, master]
+
+jobs:
+  build:
+    name: Type-check and build
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: "18.x"
+          cache: "npm"
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Type-check
+        run: npm run typecheck
+
+      - name: Build
+        run: npm run build
+
+      - name: Verify build artifacts
+        run: |
+          test -f dist/main.js
+          test -f dist/manifest.json
+          test -f dist/styles.css

.github/workflows/release.yml

@@ -22,7 +22,7 @@ jobs:
 
       - name: Build plugin
         run: |
-          npm install
+          npm ci
           npm run build
 
       - name: Generate artifact attestations

.gitignore

@@ -1,3 +1,16 @@
+# Build output (release assets are built fresh from CI/release scripts)
 node_modules/
 dist/
 *.js.map
+
+# OS junk
+.DS_Store
+Thumbs.db
+
+# Editor
+.vscode/
+.idea/
+
+# Local env / secrets
+.env
+.env.*

scripts/submit-plugin.sh

@@ -55,7 +55,7 @@ check_prerequisites() {
 
   [[ -f "$PROJECT_DIR/manifest.json" ]] || die "manifest.json not found."
 
-  if [[ ! -f "$PROJECT_DIR/README.md" ]] && [[ ! -f "$PROJECT_DIR/Readme.md" ]]; then
+  if [[ ! -f "$PROJECT_DIR/README.md" ]]; then
     die "README.md not found. It is required for plugin submission."
   fi