Ship the installable and accessible MindSwipe PWA

.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,26 @@
+---
+name: Bug report
+about: Report reproducible broken behavior
+title: "bug: "
+labels: bug
+---
+
+## What happened?
+
+## How can we reproduce it?
+
+1.
+2.
+3.
+
+## Expected behavior
+
+## Environment
+
+- Browser or Android version:
+- App version or commit:
+- Installed PWA, browser tab, or Android build:
+
+## Additional context
+
+Do not include passwords, signing keys, API credentials, or personal information.

.github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,16 @@
+---
+name: Feature request
+about: Propose a focused product improvement
+title: "feature: "
+labels: enhancement
+---
+
+## User problem
+
+## Proposed change
+
+## Why this is better than the current flow
+
+## Privacy, permissions, or store-policy impact
+
+## Smallest useful version

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,19 @@
+## What changed
+
+<!-- Describe the user-facing change. -->
+
+## Why
+
+<!-- State the problem or evidence behind it. -->
+
+## Validation
+
+- [ ] `npm ci`
+- [ ] `npm run check`
+- [ ] Tested at mobile width
+- [ ] Tested persistence after reload when relevant
+- [ ] Updated privacy/store documentation when data handling changed
+
+## Risks
+
+<!-- Note migrations, permissions, native behavior, or follow-up work. -->

.github/dependabot.yml

@@ -0,0 +1,43 @@
+version: 2
+
+updates:
+  - package-ecosystem: npm
+    directory: /
+    target-branch: main
+    schedule:
+      interval: weekly
+      day: monday
+      time: "06:00"
+      timezone: Europe/Bratislava
+    open-pull-requests-limit: 5
+    versioning-strategy: increase-if-necessary
+    commit-message:
+      prefix: deps
+      include: scope
+    groups:
+      npm-minor-and-patch:
+        patterns:
+          - "*"
+        update-types:
+          - minor
+          - patch
+
+  - package-ecosystem: github-actions
+    directory: /
+    target-branch: main
+    schedule:
+      interval: weekly
+      day: monday
+      time: "06:15"
+      timezone: Europe/Bratislava
+    open-pull-requests-limit: 5
+    commit-message:
+      prefix: deps
+      include: scope
+    groups:
+      actions-minor-and-patch:
+        patterns:
+          - "*"
+        update-types:
+          - minor
+          - patch

.github/workflows/build-android.yml

@@ -2,35 +2,41 @@ name: Build Android APK
 
 on:
   workflow_dispatch:
-  push:
-    branches:
-      - main
+
+permissions:
+  contents: read
+
+concurrency:
+  group: mindswipe-android-debug
+  cancel-in-progress: true
 
 jobs:
   build-android:
     name: Build Mind Swipe debug APK and AAB
     runs-on: ubuntu-latest
+    timeout-minutes: 45
 
     steps:
       - name: Check out repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 24
+          cache: npm
 
       - name: Set up Java
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
         with:
           distribution: temurin
           java-version: 21
 
       - name: Set up Android SDK
-        uses: android-actions/setup-android@v3
+        uses: android-actions/setup-android@40fd30fb8d7440372e1316f5d1809ec01dcd3699 # v4.0.1
 
       - name: Install dependencies
-        run: npm install
+        run: npm ci
 
       - name: Build web app
         run: npm run build
@@ -70,13 +76,17 @@ jobs:
           ./gradlew assembleDebug bundleDebug
 
       - name: Upload APK artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: MindSwipe-debug-apk
           path: android/app/build/outputs/apk/debug/app-debug.apk
+          if-no-files-found: error
+          retention-days: 14
 
       - name: Upload AAB artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: MindSwipe-debug-aab
           path: android/app/build/outputs/bundle/debug/app-debug.aab
+          if-no-files-found: error
+          retention-days: 14

.github/workflows/deploy-pages.yml

@@ -0,0 +1,67 @@
+name: Deploy web app
+
+on:
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: pages
+  cancel-in-progress: false
+
+jobs:
+  build:
+    name: Build static site
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Set up Node.js
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 24
+          cache: npm
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Verify and build
+        run: npm run check
+
+      - name: Install browser for smoke tests
+        run: npx playwright install --with-deps chromium
+
+      - name: Test desktop and Android-sized web app
+        run: npm run test:e2e
+
+      - name: Configure GitHub Pages
+        uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0
+
+      - name: Upload static site
+        uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
+        with:
+          path: dist
+
+  deploy:
+    name: Publish GitHub Pages
+    needs: build
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      pages: write
+      id-token: write
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+
+    steps:
+      - name: Deploy to GitHub Pages
+        id: deployment
+        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0

.github/workflows/quality.yml

@@ -0,0 +1,50 @@
+name: Quality
+
+on:
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: quality-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  verify:
+    name: Lint, test and build
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Set up Node.js
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 24
+          cache: npm
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Verify application
+        run: npm run check
+
+      - name: Install browser for smoke tests
+        run: npx playwright install --with-deps chromium
+
+      - name: Test desktop and Android-sized web app
+        run: npm run test:e2e
+
+      - name: Verify installable assets
+        shell: bash
+        run: |
+          test -f dist/index.html
+          test -f dist/manifest.webmanifest
+          test -f dist/sw.js
+          test -f dist/icons/icon-192.png
+          test -f dist/icons/icon-512.png
+          grep -q 'serviceWorker.register' dist/assets/*.js

.gitignore

@@ -1,6 +1,8 @@
 node_modules
 dist
 android
+playwright-report
+test-results
 *.log
 .DS_Store
 Thumbs.db

CONTRIBUTING.md

@@ -0,0 +1,21 @@
+# Contributing to MindSwipe
+
+MindSwipe is an early product, so focused fixes and evidence-backed improvements are more useful than large rewrites.
+
+## Before opening a pull request
+
+1. Open an issue for a substantial feature or data-model change.
+2. Create a short branch from `main`.
+3. Install with `npm ci` and run `npm run check`.
+4. Test the affected flow at mobile width and confirm progress survives a reload.
+5. If notifications changed, test both permission acceptance and denial on Android.
+
+## Pull-request expectations
+
+- Explain the user problem and the smallest change that solves it.
+- Keep user progress backward compatible or include an explicit migration.
+- Do not introduce tracking, advertising, accounts, remote storage, or payments without corresponding privacy and store-disclosure changes.
+- Do not commit `.env` files, signing keys, API credentials, generated Android projects, or production store certificates.
+- Identify any new dependency and why it is necessary.
+
+Content contributions must be original, practical, and free of medical, legal, investment, or guaranteed-income claims.

LICENSE

@@ -0,0 +1,7 @@
+Copyright (c) 2026 MindSwipe. All rights reserved.
+
+No license is granted to use, copy, modify, merge, publish, distribute,
+sublicense, sell, or create derivative works from this software or its
+content except with prior written permission from the copyright holder.
+
+Third-party packages remain governed by their respective licenses.