Add community scaffolding: CONTRIBUTING, SECURITY, issue templates, PR template

- CONTRIBUTING.md: dev-branch workflow, uv setup, test/lint commands
- SECURITY.md: private disclosure to holden@arch.fyi
- .github/ISSUE_TEMPLATE/bug_report.yml: structured form with image tag, versions, logs
- .github/ISSUE_TEMPLATE/feature_request.yml: problem/solution/alternatives form
- .github/PULL_REQUEST_TEMPLATE.md: checklist enforcing dev branch + passing CI
- pyproject.toml: add Changelog and Documentation URLs

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,81 @@
+name: Bug Report
+description: Something isn't working as expected
+title: "[Bug]: "
+labels: ["bug"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Before filing, check the [Troubleshooting wiki](https://github.com/sudolulo/winnow/wiki/Troubleshooting) and [existing issues](https://github.com/sudolulo/winnow/issues).
+
+  - type: dropdown
+    id: image-tag
+    attributes:
+      label: Image tag
+      description: Which winnow image are you running?
+      options:
+        - ":latest (NVIDIA CUDA)"
+        - ":rocm (AMD)"
+        - ":intel (Intel Arc / iGPU)"
+        - ":cpu (CPU only)"
+        - "Local install (uv)"
+    validations:
+      required: true
+
+  - type: input
+    id: version
+    attributes:
+      label: winnow version
+      description: Output of `docker inspect ghcr.io/sudolulo/winnow:<tag> | grep org.opencontainers.image.version` or the version in `pyproject.toml`.
+      placeholder: "0.2.13"
+    validations:
+      required: true
+
+  - type: input
+    id: immich-version
+    attributes:
+      label: Immich version
+      placeholder: "v1.110.0"
+    validations:
+      required: false
+
+  - type: input
+    id: frigate-version
+    attributes:
+      label: Frigate version
+      placeholder: "0.16.0"
+    validations:
+      required: false
+
+  - type: textarea
+    id: description
+    attributes:
+      label: What happened?
+      description: A clear description of the bug.
+    validations:
+      required: true
+
+  - type: textarea
+    id: expected
+    attributes:
+      label: What did you expect to happen?
+    validations:
+      required: true
+
+  - type: textarea
+    id: logs
+    attributes:
+      label: Relevant log output
+      description: Paste logs from `docker logs winnow` or `winnow.log`. Set `VERBOSE=true` for more detail.
+      render: text
+    validations:
+      required: false
+
+  - type: textarea
+    id: compose
+    attributes:
+      label: Relevant compose / env config
+      description: Paste your `services.winnow` block. Redact your API key.
+      render: yaml
+    validations:
+      required: false

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,36 @@
+name: Feature Request
+description: Suggest an improvement or new capability
+title: "[Feature]: "
+labels: ["enhancement"]
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: What problem does this solve?
+      description: Describe the use case or limitation you're running into.
+    validations:
+      required: true
+
+  - type: textarea
+    id: solution
+    attributes:
+      label: Proposed solution
+      description: What would you like winnow to do? New env var, different behaviour, etc.
+    validations:
+      required: true
+
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives considered
+      description: Any workarounds you've tried or other approaches you considered.
+    validations:
+      required: false
+
+  - type: checkboxes
+    id: checklist
+    attributes:
+      label: Checklist
+      options:
+        - label: I checked existing issues and this hasn't been requested before.
+          required: true

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,26 @@
+## What does this PR do?
+
+<!-- One or two sentences. -->
+
+## Why?
+
+<!-- Link to the issue this addresses, or explain the motivation if there isn't one. -->
+
+Closes #
+
+## Changes
+
+<!-- Bullet list of the meaningful changes. -->
+
+-
+
+## Testing
+
+<!-- How did you verify this works? New tests added? Manual test steps? -->
+
+## Checklist
+
+- [ ] Targets the `dev` branch (not `main`)
+- [ ] `uv run pytest` passes
+- [ ] `uv run ruff check` passes
+- [ ] `CHANGELOG.md` `[Unreleased]` section updated

CONTRIBUTING.md

@@ -0,0 +1,41 @@
+# Contributing to winnow
+
+Bug reports, feature requests, and pull requests are all welcome.
+
+## Before You Start
+
+- Check [existing issues](https://github.com/sudolulo/winnow/issues) to avoid duplicates.
+- For large changes, open an issue first to discuss the approach.
+- All PRs target the `dev` branch — never `main` directly.
+
+## Development Setup
+
+Requires Python 3.13+ and [uv](https://astral.sh/uv).
+
+```bash
+git clone https://github.com/sudolulo/winnow.git
+cd winnow
+git checkout dev
+uv sync
+```
+
+## Running Tests and Lint
+
+```bash
+uv run pytest          # run the test suite
+uv run ruff check      # lint
+uv run ruff check --fix  # auto-fix lint issues
+```
+
+CI runs both on every push and PR to `main` and `dev`. PRs must pass before merging.
+
+## Pull Request Guidelines
+
+- One logical change per PR.
+- If you add behaviour, add a test for it.
+- Keep the `CHANGELOG.md` entry in the `[Unreleased]` section updated.
+- Commit messages should be plain English describing what changed and why.
+
+## License
+
+By submitting a contribution you agree that your work will be released under the project's [AGPLv3+ license](LICENSE).

SECURITY.md

@@ -0,0 +1,17 @@
+# Security Policy
+
+## Supported Versions
+
+Only the latest release is supported with security fixes.
+
+## Reporting a Vulnerability
+
+Please do **not** open a public GitHub issue for security vulnerabilities.
+
+Email **holden@arch.fyi** with:
+
+- A description of the vulnerability and its potential impact
+- Steps to reproduce or a proof of concept
+- Any suggested fix, if you have one
+
+You will receive an acknowledgement within 48 hours. If the vulnerability is confirmed, a fix will be released as soon as possible and you will be credited in the changelog unless you prefer otherwise.

pyproject.toml

@@ -37,6 +37,8 @@ winnow = "winnow.cli:main"
 
 [project.urls]
 Repository = "https://github.com/sudolulo/winnow"
+Changelog = "https://github.com/sudolulo/winnow/blob/main/CHANGELOG.md"
+Documentation = "https://github.com/sudolulo/winnow/wiki"
 
 [tool.uv]
 conflicts = [