Add repo setup docs (#14)

Relates to #13

## Changes

- Add common repo setup instructions so that the template repos don't
need to duplicate this info

.github/pull_request_template.md

@@ -0,0 +1,15 @@
+## Ticket
+
+{LINK TO TICKET}
+
+## Changes
+
+> What was added, updated, or removed in this PR.
+
+## Context for reviewers
+
+> Testing instructions, background context, more in-depth details of the implementation, and anything else you'd like to call out or ask reviewers. Explain how the changes were verified.
+
+## Testing
+
+> Screenshots, GIF demos, code examples or output to help show the changes working as expected. ProTip: you can drag and drop or paste images into this textbox.

README.md

@@ -11,9 +11,17 @@ Application templates allow project teams to quickly spin up new production read
 We currently have the following templates:
 
 - [template-infra](https://github.com/navapbc/template-infra) - Template for setting up application infrastructure, including infrastructure for operating terraform itself.
-- [template-application-nextjs](https://github.com/navapbc/template-application-nextjs) - Template for user-facing web applications built with NextJS.
+- [template-application-nextjs](https://github.com/navapbc/template-application-nextjs) - Template for user-facing web applications built with Next.js.
 - [template-application-flask](https://github.com/navapbc/template-application-flask) - Template for APIs and offline processes built with Python Flask.
 
-### Instructions
+### Getting started
 
-TODO
+A project repository can be created using one of the application templates above. This can be done one of two ways:
+
+1. [Create a new repo](https://github.com/new) and select the desired template.
+1. From the template repo itself: Click "Use this template".
+
+Once your project repo is created:
+
+1. Copy the [pull request template](./.github/pull_request_template.md). [Learn more about PR templates](https://docs.github.com/en/communities/using-templates-to-encourage-useful-issues-and-pull-requests/creating-a-pull-request-template-for-your-repository).
+1. [Configure your repo settings](./docs/setup-new-repo.md)

docs/setup-new-repo.md

@@ -0,0 +1,35 @@
+# Initial setup steps for new project repos
+
+Below are common repo setup steps for new projects. These steps are recommendations but not required.
+
+## General settings
+
+In the project repo's `Settings > General`:
+
+- Under "Features":
+  - Enable/disable features that you want for your project. For example, turn off the Wiki if your project won't be using it.
+- Under "Pull Requests":
+  - Enable only the merge options your project should support. It's common to only support squash merging to keep the commit history clean.
+  - Check "Always suggest updating pull request branches" to encourage pull requests to be updated when they deviate from `main`
+  - Check "Automatically delete head branches" to automatically delete branches once they are merged into `main`
+
+## Branch protections
+
+[Branch protections](https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/defining-the-mergeability-of-pull-requests/about-protected-branches) are a great way to enforce code quality and prevent accidental merges.
+
+![Branches settings](./assets/add_branch_protection_rule.svg)
+
+Typical branch protections for `main` include:
+
+- Require a pull request before merging
+- Require approvals (Minimum of 1)
+- Require status checks to pass before merging
+
+## Security settings
+
+In the project repo's `Settings > Code security and analysis`:
+
+- Enable "Dependabot alerts"
+- Enable "Dependabot security updates"
+
+![Dependabot settings](./assets/code_sec_analysis.svg)