diff --git a/.gitattributes b/.gitattributes
index 6bf6abb..dd04299 100644
--- a/.gitattributes
+++ b/.gitattributes
@@ -7,13 +7,12 @@
 *.yaml text eol=lf
 *.md text eol=lf
 
+# GitHub community files and workflows are public release inputs. The release
+# controller enforces their exact allowlist before export.
 # Keep internal development and release-process files out of public exports.
-/.github export-ignore
-/.github/** export-ignore
 /.gitlab export-ignore
 /.gitlab/** export-ignore
-/scripts export-ignore
-/scripts/** export-ignore
+/.gitlab-ci.yml export-ignore
 /AGENTS.md export-ignore
 /CLAUDE.md export-ignore
 /CHANGELOG.md export-ignore
diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
new file mode 100644
index 0000000..bfbcf84
--- /dev/null
+++ b/.github/CODEOWNERS
@@ -0,0 +1,2 @@
+# Repository owner. Replace this entry if project ownership changes.
+* @tpn
diff --git a/.github/ISSUE_TEMPLATE/bug.yml b/.github/ISSUE_TEMPLATE/bug.yml
new file mode 100644
index 0000000..cf7fa34
--- /dev/null
+++ b/.github/ISSUE_TEMPLATE/bug.yml
@@ -0,0 +1,62 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+#
+# SPDX-License-Identifier: Apache-2.0
+
+name: Bug report
+description: Report a reproducible problem in cuPhoton.
+title: "[Bug]: "
+labels: ["bug"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Do not report security vulnerabilities here. Follow SECURITY.md.
+  - type: dropdown
+    id: component
+    attributes:
+      label: Component
+      options:
+        - cuphoton.core
+        - cuphoton.xdr
+        - cuphoton.xfit
+        - cuphoton.xpois
+        - cuphoton.xscan
+        - cuphoton.xrep
+        - cuphoton.xray
+        - repository infrastructure
+    validations:
+      required: true
+  - type: textarea
+    id: summary
+    attributes:
+      label: Summary
+      description: What failed?
+    validations:
+      required: true
+  - type: textarea
+    id: reproduce
+    attributes:
+      label: Reproduction
+      description: Provide commands, inputs, and a minimal reproducer when possible.
+      render: bash
+    validations:
+      required: true
+  - type: textarea
+    id: environment
+    attributes:
+      label: Environment
+      description: Include OS, Python, CUDA, GPU, driver, and package revisions.
+    validations:
+      required: true
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected behavior
+    validations:
+      required: true
+  - type: textarea
+    id: observed
+    attributes:
+      label: Observed behavior
+    validations:
+      required: true
diff --git a/.github/ISSUE_TEMPLATE/config.yml b/.github/ISSUE_TEMPLATE/config.yml
new file mode 100644
index 0000000..c54249e
--- /dev/null
+++ b/.github/ISSUE_TEMPLATE/config.yml
@@ -0,0 +1,9 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+#
+# SPDX-License-Identifier: Apache-2.0
+
+blank_issues_enabled: false
+contact_links:
+  - name: NVIDIA Security Vulnerability Submission
+    url: https://www.nvidia.com/object/submit-security-vulnerability.html
+    about: Report potential security vulnerabilities privately.
diff --git a/.github/ISSUE_TEMPLATE/feature.yml b/.github/ISSUE_TEMPLATE/feature.yml
new file mode 100644
index 0000000..62696ce
--- /dev/null
+++ b/.github/ISSUE_TEMPLATE/feature.yml
@@ -0,0 +1,43 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+#
+# SPDX-License-Identifier: Apache-2.0
+
+name: Feature request
+description: Propose a new cuPhoton capability.
+title: "[Feature]: "
+labels: ["enhancement"]
+body:
+  - type: dropdown
+    id: component
+    attributes:
+      label: Component
+      options:
+        - cuphoton.core
+        - cuphoton.xdr
+        - cuphoton.xfit
+        - cuphoton.xpois
+        - cuphoton.xscan
+        - cuphoton.xrep
+        - cuphoton.xray
+        - repository infrastructure
+    validations:
+      required: true
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem
+      description: What user need or workflow gap does this address?
+    validations:
+      required: true
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposal
+      description: Describe the requested behavior and likely implementation scope.
+    validations:
+      required: true
+  - type: textarea
+    id: validation
+    attributes:
+      label: Validation
+      description: How should maintainers verify this works?
diff --git a/.github/ISSUE_TEMPLATE/task.yml b/.github/ISSUE_TEMPLATE/task.yml
new file mode 100644
index 0000000..af18187
--- /dev/null
+++ b/.github/ISSUE_TEMPLATE/task.yml
@@ -0,0 +1,28 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+#
+# SPDX-License-Identifier: Apache-2.0
+
+name: Task
+description: Track repository maintenance, documentation, or release work.
+title: "[Task]: "
+labels: ["task"]
+body:
+  - type: textarea
+    id: objective
+    attributes:
+      label: Objective
+      description: What should be completed?
+    validations:
+      required: true
+  - type: textarea
+    id: scope
+    attributes:
+      label: Scope
+      description: Files, components, or workflows affected.
+  - type: textarea
+    id: done
+    attributes:
+      label: Done when
+      description: Concrete acceptance criteria.
+    validations:
+      required: true
diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md
new file mode 100644
index 0000000..2b559e6
--- /dev/null
+++ b/.github/PULL_REQUEST_TEMPLATE.md
@@ -0,0 +1,22 @@
+## Summary
+
+Describe the change and the affected `cuphoton.*` component or workflow.
+
+## Validation
+
+List the commands run and their results.
+
+```bash
+uv lock --check
+uv run --locked --extra dev pre-commit run --all-files
+make lint
+make test-cpu
+```
+
+## Repository hygiene
+
+- [ ] No credentials, private paths, local datasets, notebook outputs, or generated run artifacts were added.
+- [ ] Large binary artifacts are excluded or intentionally tracked through an approved storage plan.
+- [ ] Security-sensitive information is not included.
+- [ ] User-visible behavior changes are documented.
+- [ ] New dependencies and their licenses are documented.