diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS new file mode 100644 index 0000000..c96e675 --- /dev/null +++ b/.github/CODEOWNERS @@ -0,0 +1,25 @@ +# CODEOWNERS -- Daytona Integrations +# Listed owners are automatically requested for review on PRs that modify the +# matching files. Multiple owners = OR semantics (any one can approve). + +# Security and compliance policies +SECURITY.md @mislavivanda @aprojic +CODE_OF_CONDUCT.md @mislavivanda @aprojic + +# Contributor License Agreement (legal) +CLA.md @mislavivanda @aprojic + +# Licensing and copyright +LICENSE @mislavivanda @aprojic +COPYRIGHT @mislavivanda @aprojic +NOTICE @mislavivanda @aprojic + +# CI/CD workflows +.github/workflows/ @mislavivanda + +# CLA/DCO enforcement (compliance controls) +.github/workflows/cla.yml @mislavivanda @aprojic +.github/workflows/dco.yml @mislavivanda @aprojic + +# CODEOWNERS itself (must protect itself) +.github/CODEOWNERS @mislavivanda @aprojic diff --git a/.github/ISSUE_TEMPLATE/bug_report.md b/.github/ISSUE_TEMPLATE/bug_report.md new file mode 100644 index 0000000..6482328 --- /dev/null +++ b/.github/ISSUE_TEMPLATE/bug_report.md @@ -0,0 +1,38 @@ +--- +name: Bug report +about: Create a report to help us improve +title: '' +type: Bug +assignees: '' +--- + +**Describe the bug** +A clear and concise description of what the bug is. + +**Which package or app?** +The integration this affects, e.g. `packages/pi-extension`, `packages/adk-plugin`, or +`apps/dify-plugin`. + +**To Reproduce** +Steps to reproduce the behavior: + +1. Use these parameters '...' +2. Click on '...' +3. Execute the following command '...' +4. See error + +**Expected behavior** +A clear and concise description of what you expected to happen. + +**Screenshots** +If applicable, add screenshots to help explain your problem. + +**Environment (please provide what's relevant):** + +- Package/app + version: [e.g. `@daytona/pi` v0.0.1, `daytona-adk` v0.0.1] +- Daytona SDK version: [e.g. `daytona` 0.x] +- Runtime: [e.g. Node.js 20.x / Python 3.12] +- OS: [e.g. macOS 14, Ubuntu 24.04] + +**Additional context** +Add any other context about the problem here. diff --git a/.github/ISSUE_TEMPLATE/feature_request.md b/.github/ISSUE_TEMPLATE/feature_request.md new file mode 100644 index 0000000..db02b39 --- /dev/null +++ b/.github/ISSUE_TEMPLATE/feature_request.md @@ -0,0 +1,31 @@ +--- +name: Feature request +about: Propose a new integration or an improvement to an existing one +title: '' +type: Feature +assignees: '' +--- + +**What kind of request is this?** + +- [ ] A **new** integration, plugin, or tool +- [ ] A **feature or improvement** for an existing package/app + +**Which integration?** +For an existing one, name the package/app (e.g. `packages/pi-extension`, `apps/dify-plugin`). +For a new one, name the platform or tool you'd like Daytona to integrate with (e.g. n8n, +LangChain, a coding agent framework). + +**What problem does it solve?** +A clear and concise description of the problem or use case. Ex. "When using Daytona with +[...], I can't [...]" + +**Describe the solution you'd like** +What should the integration do? Include the key capabilities, tools, or commands it should +expose. + +**Describe alternatives you've considered** +Any alternative solutions, existing workarounds, or other tools you've considered. + +**Additional context** +Links to the target platform's docs/API, screenshots, or any other context. diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md new file mode 100644 index 0000000..5dd6441 --- /dev/null +++ b/.github/pull_request_template.md @@ -0,0 +1,31 @@ +## Description + +Summarize the change and its motivation. List any dependencies this change requires. + +## Related issue(s) + + + +## Scope + +- [ ] This PR touches **no more than one package/app** (release routing is by changed file path). +- [ ] The **PR title** follows [Conventional Commits](https://www.conventionalcommits.org/) + (e.g. `feat(pi-extension): ...`, `fix(adk-plugin): ...`) — it becomes the squash-commit + message that release-please reads. + +## Checks + +- [ ] I ran the affected package's lint/build/test locally and they pass. +- [ ] I updated documentation where relevant. + +## Legal + +- [ ] Every commit is **signed off** for the + [DCO](https://developercertificate.org/) (`git commit -s`); the sign-off matches the + commit author. +- [ ] I agree to the + [Contributor License Agreement](https://github.com/daytona/integrations/blob/main/CLA.md). + On my first PR, the CLA assistant will comment and I will reply to sign (once). + +See [CONTRIBUTING.md](https://github.com/daytona/integrations/blob/main/CONTRIBUTING.md) for +details. diff --git a/.github/workflows/cla.yml b/.github/workflows/cla.yml new file mode 100644 index 0000000..1ab9dbb --- /dev/null +++ b/.github/workflows/cla.yml @@ -0,0 +1,70 @@ +name: '[PR] CLA Assistant' + +on: + issue_comment: + types: [created] + pull_request_target: + types: [opened, closed, synchronize] + +# Least-privilege token. `pull_request_target` runs in the BASE repo context so +# that PRs from forks can still write the signature file and set the status +# check. This job must ONLY run the trusted CLA action -- never check out or +# execute the PR head's code here. +permissions: + actions: write # re-run the check via the rerun API + contents: write # commit the signature file to the signatures branch + pull-requests: write # post / refresh the CLA comment + statuses: write # set the pass/fail commit status that gates merge + +# Serialize CLA runs repo-wide: every PR writes the same signatures branch/file, +# so concurrent signatures could otherwise race and lose a write. Queue, don't +# cancel, so no signature is dropped. +concurrency: + group: cla-signatures + cancel-in-progress: false + +jobs: + cla-assistant: + name: CLA signed + runs-on: ubuntu-latest + steps: + - name: CLA Assistant + if: >- + (github.event_name == 'issue_comment' && + github.event.issue.pull_request != null && + (github.event.comment.body == 'recheck' || + github.event.comment.body == 'I have read the CLA Document and I hereby sign the CLA')) || + (github.event_name == 'pull_request_target' && + (github.event.action != 'closed' || github.event.pull_request.merged == true)) + # contributor-assistant/github-action v2.6.1 (upstream archived -- pin by SHA) + uses: contributor-assistant/github-action@ca4a40a7d1004f18d9960b404b97e5f30a505a08 + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + with: + # Where signatures are stored, committed to `branch` below. That branch + # may be protected against force-pushes and deletions, but must NOT + # restrict who can push, require pull requests, or be locked -- the + # default GITHUB_TOKEN pushes normal signature commits directly to it. + path-to-signatures: 'signatures/version1/cla.json' + branch: 'cla-signatures' + # The document contributors are agreeing to. + path-to-document: 'https://github.com/daytona/integrations/blob/main/CLA.md' + # Bots and automation cannot sign -- exempt them. Explicit logins only: + # a `bot*` wildcard would let a human register a matching username + # (e.g. "bottle") and bypass the CLA gate. + allowlist: 'dependabot[bot],renovate[bot],github-actions[bot]' + # Lock the PR conversation after merge so a signature comment can't be + # deleted/revoked after the fact. + lock-pullrequest-aftermerge: true + custom-notsigned-prcomment: >- + Thank you for your contribution! Before we can merge it, we need you + to sign the [Daytona Contributor License Agreement](https://github.com/daytona/integrations/blob/main/CLA.md). + You only need to do this once, and it will cover all of your future + contributions to this repository. If you are signing on behalf of an + entity (for example, your employer), please also reply with the + entity's legal name and your role or title, and confirm that you are + authorized to bind it. Please read the CLA and, if you agree, post the + following comment on this PR: + custom-pr-sign-comment: 'I have read the CLA Document and I hereby sign the CLA' + custom-allsigned-prcomment: >- + All contributors have signed the CLA. ✅ Thank you! diff --git a/.github/workflows/dco.yml b/.github/workflows/dco.yml new file mode 100644 index 0000000..237e534 --- /dev/null +++ b/.github/workflows/dco.yml @@ -0,0 +1,92 @@ +# Developer Certificate of Origin (DCO) enforcement. +# +# Every non-merge commit in a pull request must carry a `Signed-off-by:` trailer +# whose email matches the commit author, certifying the DCO v1.1 +# (https://developercertificate.org/). Contributors add it with `git commit -s`. +# +# Self-contained: reads the PR's commits via the API and validates each sign-off +# (no external app/action to install). Runs on `pull_request` with a read-only +# token, so it is safe for fork PRs. The `DCO` job is the stable status to +# require in branch protection. + +name: dco + +on: + pull_request: + types: [opened, synchronize, reopened] + +permissions: + contents: read + pull-requests: read + +jobs: + dco: + name: DCO + runs-on: ubuntu-latest + steps: + - name: Check Signed-off-by on every commit + env: + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + PR: ${{ github.event.pull_request.number }} + REPO: ${{ github.repository }} + # Bots and automation cannot sign off -- exempt them. Explicit logins only. + ALLOWLIST: 'dependabot[bot],renovate[bot],github-actions[bot]' + run: | + set -euo pipefail + + # Authoritative commit list for this PR (works for forks). --slurp wraps + # each page as an array element; `add` flattens them into one array. + commits=$(gh api --paginate --slurp "repos/$REPO/pulls/$PR/commits" | jq 'add') + len=$(jq 'length' <<<"$commits") + echo "Checking $len commit(s) in PR #$PR" + + fail=0 + for i in $(seq 0 $((len - 1))); do + sha=$(jq -r ".[$i].sha" <<<"$commits") + short=${sha:0:7} + + # Skip merge commits (2+ parents): they carry no authored content. + if [ "$(jq -r ".[$i].parents | length" <<<"$commits")" -ge 2 ]; then + echo "skip $short (merge commit)" + continue + fi + + # Skip allowlisted bot authors (they cannot add a sign-off). `.author.login` + # is GitHub's resolution of the commit to a real account (null if the email + # isn't linked), so it can't be forged by setting an arbitrary git author. + login=$(jq -r ".[$i].author.login // \"\"" <<<"$commits") + case ",$ALLOWLIST," in + *",$login,"*) echo "skip $short (allowlisted: $login)"; continue ;; + esac + + author_email=$(jq -r ".[$i].commit.author.email" <<<"$commits" | tr '[:upper:]' '[:lower:]') + message=$(jq -r ".[$i].commit.message" <<<"$commits") + + # Extract sign-off emails from the actual trailer block only, via + # `git interpret-trailers` -- a loose "Signed-off-by:" line elsewhere in + # the body must NOT count (case-insensitive email match). + signoff_emails=$(printf '%s\n' "$message" \ + | git interpret-trailers --parse \ + | grep -iE '^Signed-off-by:[[:space:]]*.+<.+>' \ + | sed -E 's/.*<([^>]+)>.*/\1/' \ + | tr '[:upper:]' '[:lower:]' || true) + + if printf '%s\n' "$signoff_emails" | grep -qxF "$author_email"; then + echo "ok $short ($author_email)" + else + echo "FAIL $short: no 'Signed-off-by:' matching author <$author_email>" + fail=1 + fi + done + + if [ "$fail" -ne 0 ]; then + echo "" + echo "::error::One or more commits are missing a matching DCO sign-off." + echo "Add one to each commit, then push again:" + echo " - new commits: git commit -s" + echo " - existing commits: git rebase --signoff && git push --force-with-lease" + echo "The sign-off email must match the commit author. See CONTRIBUTING.md" + echo "and https://developercertificate.org/." + exit 1 + fi + echo "All commits carry a valid DCO sign-off." diff --git a/CLA.md b/CLA.md new file mode 100644 index 0000000..d027bbd --- /dev/null +++ b/CLA.md @@ -0,0 +1,177 @@ +# Daytona Contributor License Agreement ("Agreement") + +Thank you for your interest in Daytona Platforms, Inc. ("Daytona", "We", or +"Us"). This Agreement documents the rights granted to Us by contributors, whether +You are an individual contributing on Your own behalf or a legal entity (such as +a company) contributing through Your employees or agents. This is a legally +binding document, so please read it carefully before agreeing to it. + +> **How to sign.** You accept this Agreement electronically through our CLA +> assistant. When you open your first pull request to the `daytona/integrations` +> repository, the CLA assistant will comment with a link to this Agreement and +> ask you to confirm your acceptance by posting the exact comment it provides. By +> posting that comment, You affirmatively sign, and agree to be legally bound by, +> this Agreement. If You are accepting on behalf of an entity (for example, Your +> employer), by doing so You confirm that You are authorized to bind that entity +> to this Agreement. If accepting on behalf of an entity, You must identify the +> entity's legal name and Your role or title, or otherwise provide the information +> requested by the CLA assistant to confirm the entity on whose behalf You are +> accepting. Your GitHub identity and the date of your acceptance are recorded as +> your signature. This Agreement applies to the Contributions included in the pull +> request in which You accept this Agreement, and to all Contributions You Submit +> to Us after that acceptance. + +## 1. Definitions + +**"You"** (or **"Your"**) means the individual or legal entity that accepts this +Agreement. For a legal entity, the entity on whose behalf a Contribution is +Submitted is the Contributor, and the individual accepting this Agreement +represents that they are authorized to bind that entity to it. If the acceptance +record identifies an entity, "You" means that entity; otherwise, "You" means the +individual associated with the recorded GitHub account. + +**"Contribution"** means any original work of authorship, including any +modifications or additions to an existing work, that is Submitted by You to Us in +which You own or assert ownership of the Copyright. + +**"Copyright"** means all rights protecting works of authorship, including +copyright, moral, and neighboring rights, as appropriate, for the full term of +their existence. + +**"Submit"** means any form of electronic, verbal, or written communication sent +to Us or Our representatives, including but not limited to communication on +electronic mailing lists, source code control systems, and issue tracking +systems that are managed by, or on behalf of, Us for the purpose of discussing +and improving the Material, but excluding communication that is conspicuously +marked or otherwise designated in writing by You as "Not a Contribution." + +**"Material"** means the software project owned or managed by Us to which a +Contribution is Submitted, specifically the `daytona/integrations` repository. + +## 2. Scope and Consideration + +This Agreement applies to the Contributions included in the pull request in which +You accept this Agreement, and to all Contributions You Submit to Us after that +acceptance. You grant the rights set out in this Agreement in consideration of, +and as a condition of, the opportunity to participate in the Material and to have +Your Contributions considered for inclusion in it. No monetary or other payment +is or will be owed to You for Your Contributions or for entering into this +Agreement. The representations in Section 6 apply to each Contribution You Submit, +whether on Your own behalf or on behalf of an entity. + +## 3. Grant of Copyright License + +Subject to the terms of this Agreement, You hereby grant to Us and to recipients +of software distributed by Us a perpetual, worldwide, non-exclusive, no-charge, +royalty-free, irrevocable license, with the right to sublicense to recipients of +software distributed by Us under terms We choose, under Your Copyright to +reproduce, prepare derivative works of, publicly display, publicly perform, +sublicense, and distribute Your Contributions and such derivative works. To the +maximum extent permitted by law, You waive and agree not to assert any moral +rights, neighboring rights, or similar rights in Your Contributions against Us, +Our sublicensees, or recipients of software distributed by Us. + +## 4. Grant of Patent License + +Subject to the terms of this Agreement, You hereby grant to Us and to recipients +of software distributed by Us a perpetual, worldwide, non-exclusive, no-charge, +royalty-free, irrevocable (except as stated in this section) patent license, with +the right to sublicense to recipients of software distributed by Us under terms +We choose, to make, have made, use, offer to sell, sell, import, and otherwise +transfer the Material, where such license applies only to those patent claims +licensable by You that are necessarily infringed by Your Contribution(s) alone or +by combination of Your Contribution(s) with the Material to which such +Contribution(s) was Submitted. If any entity institutes patent litigation +against You or any other entity (including a cross-claim or counterclaim in a +lawsuit) alleging that Your Contribution, or the Material to which You have +contributed, constitutes direct or contributory patent infringement, then any +patent licenses granted to that entity under this Agreement for that Contribution +or Material shall terminate as of the date such litigation is filed. + +## 5. Outbound License (Relicensing Rights) + +Based on the grant of rights in Sections 3 and 4, We may license the Contribution +under any license terms We choose, including copyleft, permissive, commercial, +and proprietary licenses. You acknowledge that We currently distribute the +Material under the Apache License 2.0 (with certain packages made available under +the MIT License, as indicated by the LICENSE file in the applicable directory), +and that We may, in addition, offer the Material and Your Contribution under +separate commercial or proprietary terms, and may change the license or the +visibility of the Material, for future versions, distributions, or releases, at +any time, in Our sole discretion and without further notice to, consent from, or +payment to You. Nothing in this Agreement requires Us to use Your Contribution in +any product or under any license. + +## 6. Your Representations + +You represent that: + +(a) You are legally entitled, and have the legal capacity, to enter into this +Agreement and grant the above licenses. If You are an individual and Your +employer(s) has rights to intellectual property that You create that includes +Your Contributions, You represent that You have received permission to make +Contributions on behalf of that employer, that Your employer has waived such +rights for Your Contributions to Us, that Your employer has authorized You to +accept this Agreement on its behalf, or that Your employer has otherwise entered +into a written or electronic agreement with Us covering such Contributions. + +(b) If You are, or are accepting this Agreement on behalf of, a legal entity, You +represent that You are authorized to enter into this Agreement on that entity's +behalf, that it binds the entity, and that it covers Contributions Submitted to +Us by the entity's employees and agents on its behalf, including Contributions +submitted through the GitHub account recorded in the CLA assistant acceptance +process. + +(c) Each of Your Contributions is Your original creation. + +(d) Your Contribution submissions include complete details of any third-party +license or other restriction (including, but not limited to, related patents and +trademarks) of which You are personally aware and which are associated with any +part of Your Contributions. + +## 7. Disclaimer + +You are not expected to provide support for Your Contributions, except to the +extent You desire to provide support. Unless required by applicable law or agreed +to in writing, You provide Your Contributions on an "AS IS" BASIS, WITHOUT +WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, +without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, +MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. + +## 8. Notice + +You agree to notify Us of any facts or circumstances of which You become aware +that would make these representations inaccurate in any respect. + +## 9. Miscellaneous + +This Agreement will be governed by the laws of the State of Massachusetts, +without regard to any provision of law that would require or permit the +application of the substantive law of any other jurisdiction. In the event of a +dispute, the federal or state courts located in Massachusetts shall have exclusive +jurisdiction. + +If any provision of this Agreement is, for any reason, held to be invalid or +unenforceable, the other provisions of this Agreement will remain enforceable and +the invalid or unenforceable provision will be deemed modified so that it is +valid and enforceable to the maximum extent permitted by law. Any waiver or +failure to enforce any provision of this Agreement on one occasion will not be +deemed a waiver of any other provision or of such provision on any other +occasion. + +Each party shall execute and deliver any and all additional papers, documents, +and other assurances, and shall do any and all acts and things reasonably +necessary in connection with the performance of its obligations under this +Agreement, to carry out the intent of this Agreement. + +This Agreement constitutes the entire agreement between the parties with respect +to Contributions Submitted through the electronic acceptance process described +above, and does not amend, replace, or supersede any separate written contributor, +including any previously executed individual contributor license agreements, or +corporate license agreement previously executed between You and Us, unless that +agreement expressly states otherwise. This Agreement may only be amended in a +writing signed by duly authorized representatives of the parties. + +This Agreement may be executed in one or more counterparts, or accepted +electronically, each of which shall be deemed an original, but all of which +together will constitute one instrument. diff --git a/CODE_OF_CONDUCT.md b/CODE_OF_CONDUCT.md new file mode 100644 index 0000000..8ac63bd --- /dev/null +++ b/CODE_OF_CONDUCT.md @@ -0,0 +1,133 @@ +# Contributor Covenant Code of Conduct + +## Our Pledge + +We as members, contributors, and leaders pledge to make participation in our +community a harassment-free experience for everyone, regardless of age, body +size, visible or invisible disability, ethnicity, sex characteristics, gender +identity and expression, level of experience, education, socio-economic status, +nationality, personal appearance, race, caste, color, religion, or sexual +identity and orientation. + +We pledge to act and interact in ways that contribute to an open, welcoming, +diverse, inclusive, and healthy community. + +## Our Standards + +Examples of behavior that contributes to a positive environment for our +community include: + +* Demonstrating empathy and kindness toward other people +* Being respectful of differing opinions, viewpoints, and experiences +* Giving and gracefully accepting constructive feedback +* Accepting responsibility and apologizing to those affected by our mistakes, + and learning from the experience +* Focusing on what is best not just for us as individuals, but for the overall + community + +Examples of unacceptable behavior include: + +* The use of sexualized language or imagery, and sexual attention or advances of + any kind +* Trolling, insulting or derogatory comments, and personal or political attacks +* Public or private harassment +* Publishing others' private information, such as a physical or email address, + without their explicit permission +* Other conduct which could reasonably be considered inappropriate in a + professional setting + +## Enforcement Responsibilities + +Community leaders are responsible for clarifying and enforcing our standards of +acceptable behavior and will take appropriate and fair corrective action in +response to any behavior that they deem inappropriate, threatening, offensive, +or harmful. + +Community leaders have the right and responsibility to remove, edit, or reject +comments, commits, code, wiki edits, issues, and other contributions that are +not aligned to this Code of Conduct, and will communicate reasons for moderation +decisions when appropriate. + +## Scope + +This Code of Conduct applies within all community spaces, and also applies when +an individual is officially representing the community in public spaces. +Examples of representing our community include using an official email address, +posting via an official social media account, or acting as an appointed +representative at an online or offline event. + +## Enforcement + +Instances of abusive, harassing, or otherwise unacceptable behavior may be +reported to the community leaders responsible for enforcement at +codeofconduct@daytona.io. + +All complaints will be reviewed and investigated promptly and fairly. + +All community leaders are obligated to respect the privacy and security of the +reporter of any incident. + +## Enforcement Guidelines + +Community leaders will follow these Community Impact Guidelines in determining +the consequences for any action they deem in violation of this Code of Conduct: + +### 1. Correction + +**Community Impact**: Use of inappropriate language or other behavior deemed +unprofessional or unwelcome in the community. + +**Consequence**: A private, written warning from community leaders, providing +clarity around the nature of the violation and an explanation of why the +behavior was inappropriate. A public apology may be requested. + +### 2. Warning + +**Community Impact**: A violation through a single incident or series of +actions. + +**Consequence**: A warning with consequences for continued behavior. No +interaction with the people involved, including unsolicited interaction with +those enforcing the Code of Conduct, for a specified period of time. This +includes avoiding interactions in community spaces as well as external channels +like social media. Violating these terms may lead to a temporary or permanent +ban. + +### 3. Temporary Ban + +**Community Impact**: A serious violation of community standards, including +sustained inappropriate behavior. + +**Consequence**: A temporary ban from any sort of interaction or public +communication with the community for a specified period of time. No public or +private interaction with the people involved, including unsolicited interaction +with those enforcing the Code of Conduct, is allowed during this period. +Violating these terms may lead to a permanent ban. + +### 4. Permanent Ban + +**Community Impact**: Demonstrating a pattern of violation of community +standards, including sustained inappropriate behavior, harassment of an +individual, or aggression toward or disparagement of classes of individuals. + +**Consequence**: A permanent ban from any sort of public interaction within the +community. + +## Attribution + +This Code of Conduct is adapted from the [Contributor Covenant][homepage], +version 2.1, available at +[https://www.contributor-covenant.org/version/2/1/code_of_conduct.html][v2.1]. + +Community Impact Guidelines were inspired by +[Mozilla's code of conduct enforcement ladder][Mozilla CoC]. + +For answers to common questions about this code of conduct, see the FAQ at +[https://www.contributor-covenant.org/faq][FAQ]. Translations are available at +[https://www.contributor-covenant.org/translations][translations]. + +[homepage]: https://www.contributor-covenant.org +[v2.1]: https://www.contributor-covenant.org/version/2/1/code_of_conduct.html +[Mozilla CoC]: https://github.com/mozilla/diversity +[FAQ]: https://www.contributor-covenant.org/faq +[translations]: https://www.contributor-covenant.org/translations diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md new file mode 100644 index 0000000..327925b --- /dev/null +++ b/CONTRIBUTING.md @@ -0,0 +1,75 @@ +# Contributing to Daytona Integrations + +This repository is a monorepo of community and partner **integrations, plugins, and tools** +for [Daytona](https://www.daytona.io). Each package in [`packages/`](packages/) is versioned, +released, and published independently; the apps in [`apps/`](apps/) are standalone projects +that aren't published to a registry. Contributions are welcome! ❤️ + +> If you like the project but don't have time to contribute, you can still help by starring +> the repo, telling others about it, or referencing it in your own project's README. + +## Code of Conduct + +This project is governed by the [Daytona Code of Conduct](./CODE_OF_CONDUCT.md). By +participating, you are expected to uphold it. Please report unacceptable behavior to +[codeofconduct@daytona.io](mailto:codeofconduct@daytona.io). + +## Provide feedback + +Found a bug or have an idea? Please +[open an issue](https://github.com/daytona/integrations/issues/new) — but first check that a +matching issue doesn't already exist. + +## What you can contribute + +- Bug fixes and new features in an existing package under [`packages/`](packages/) or app + under [`apps/`](apps/). +- New integrations, plugins, or tools (please open an issue first to discuss the fit). +- Documentation improvements. + +## Submitting a pull request + +1. [Fork](https://help.github.com/articles/working-with-forks/) the repository and create a + branch for your change. +2. Keep each PR scoped to **no more than one package or app** (docs-only or repo-wide changes + are fine). For packages, release routing is by changed file path, not the scope text. +3. PRs are **squash-merged**, so the **PR title must be a + [Conventional Commit](https://www.conventionalcommits.org/)** — e.g. + `feat(pi-extension): add X`, `fix(adk-plugin): handle Y`. That title becomes the squash + commit that [release-please](https://github.com/googleapis/release-please) reads to decide + the version bump and changelog. +4. **Sign off every commit** with `git commit -s` to comply with the DCO (see + [Licensing](#licensing)). +5. Develop within the package's own folder — each is self-contained, with its own dependency + manifest and `LICENSE`. Run that package's lint/build/test before opening the PR. +6. Open the pull request (a + [draft PR](https://help.github.com/en/articles/about-pull-requests#draft-pull-requests) is + welcome for early feedback). A Daytona team member will review it, and once approved and + green it will be merged into `main`. + +The first time you open a PR, our CLA assistant will also comment with a link to the +[Contributor License Agreement](./CLA.md) and a one-line instruction to sign it (see +[Licensing](#licensing)). + +## Licensing + +This repository is made available under [Apache-2.0](./LICENSE), unless a package declares +otherwise — each package includes its own `LICENSE` (a few are MIT). Contributing involves +two steps: + +1. **DCO sign-off (per commit).** Sign off every commit with `git commit -s` to certify, under + the [Developer Certificate of Origin](https://developercertificate.org/) v1.1, that you have + the right to submit the code. The sign-off email must match the commit author's email. A + DCO check runs on every pull request. + +2. **CLA signature (once).** You must also sign the + [Daytona Contributor License Agreement](./CLA.md) — it covers both individual and + entity/corporate contributors. You (or, for entity contributors, your organization) retain + copyright in your contributions, but you grant Daytona Platforms, Inc. a perpetual, + irrevocable, sublicensable license to them — **including the right to relicense and + redistribute the software under any terms (open source, proprietary, or closed source) and + to change the license or visibility of the project at any time.** A CLA assistant bot will + comment on your first pull request with a link and a one-line instruction to sign; a single + signature covers all your future contributions to this repository. + +Your PR cannot be merged until both the DCO check and the CLA check are green. diff --git a/COPYRIGHT b/COPYRIGHT new file mode 100644 index 0000000..40e07e3 --- /dev/null +++ b/COPYRIGHT @@ -0,0 +1,18 @@ +Copyrights in the Daytona software are retained by their respective +contributors. Contributors keep ownership of the copyright in their +contributions; no copyright assignment is required. + +By contributing, each contributor agrees to the Daytona Contributor License +Agreement (see CLA.md), under which they grant Daytona Platforms, Inc. a +perpetual, irrevocable, sublicensable license to their contributions. This +license includes the right for Daytona to relicense and redistribute the +software (and any contribution) under any terms of Daytona's choosing, +including proprietary or closed-source terms, and to change the license or +visibility of the software at any time. + +When we refer to the 'Daytona software authors', we mean anyone who has +contributed to this repository. + +Unless otherwise noted, such as with a LICENSE file in a directory, or a +specific copyright notice on a file, all files in this repository are currently +made available under the Apache 2.0 license. diff --git a/NOTICE b/NOTICE new file mode 100644 index 0000000..6fd231d --- /dev/null +++ b/NOTICE @@ -0,0 +1,5 @@ +Daytona +Copyright the various Daytona software authors. + +The initial developer of the software is Daytona Platforms, Inc. (https://daytona.io). +Copyright Daytona Platforms, Inc. All Rights Reserved. diff --git a/README.md b/README.md index 0932c68..b5517eb 100644 --- a/README.md +++ b/README.md @@ -34,8 +34,8 @@ Versioning is **per package**, automated with [release-please](https://github.co ## Contributing - PRs are **squash-merged**, so the **PR title must be a [Conventional Commit](https://www.conventionalcommits.org/)** — e.g. `feat(pi-extension): add X`, `fix(adk-plugin): handle Y`. `feat` → minor, `fix` → patch, `feat!` / `BREAKING CHANGE:` → major; `chore`/`docs`/`ci` → no release. -- Keep each PR scoped to **one package** — release routing is by changed file path, not the scope text. -- Each package is self-contained (its own lockfile and dependencies); develop within its folder. +- Keep each PR scoped to **no more than one package or app** — for packages, release routing is by changed file path, not the scope text. +- Each package/app is self-contained (its own dependency manifest); develop within its folder. ## License diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..dba4611 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,85 @@ +# Security Policy + +## Reporting a Vulnerability + +At Daytona, we take security seriously. If you believe you have found a security vulnerability in any Daytona-owned repository or service, please report it responsibly. + +**Please do NOT report security vulnerabilities through public GitHub issues.** + +Instead, please email us at: **security@daytona.io** + +You can also report vulnerabilities privately through [GitHub's security advisory feature](https://github.com/daytona/integrations/security/advisories/new). + +Please include: + +- Description of the vulnerability +- Steps to reproduce +- Impact assessment +- Any relevant screenshots or proof-of-concept + +We will acknowledge receipt within 2 business days and provide an initial assessment within 5 business days. + +## Scope + +The following assets and areas are in scope for vulnerability reports: + +- **Daytona platform** — app.daytona.io, including the web application and management interfaces +- **API and SDK** — all documented and undocumented API endpoints, client SDKs +- **Sandbox runtime isolation** — escape from sandbox to host, cross-tenant access, isolation boundary bypasses +- **Authentication and authorization** — SSO, API key management, session handling, privilege escalation across accounts or organizations +- **Secrets management** — scoped secret injection, unauthorized access to secrets, leakage across sandbox boundaries +- **Public GitHub repositories** — any repository under the [daytona](https://github.com/daytona) organization + +## Excluded Submission Types + +The following categories are excluded from this program. Reports in these categories will be closed without further assessment unless they demonstrate impact beyond what is described. + +1. **In-sandbox privilege escalation, root access, or capability use** — Daytona sandboxes provide full root access within user-namespace isolation by design. Findings that chain to host escape or cross-sandbox access remain in scope. +2. **Findings within the reporter's own sandbox** that do not demonstrate impact beyond that sandbox's isolation boundary. +3. **Denial of service** — DoS, DDoS, resource exhaustion, volumetric testing, or network flooding. +4. **Rate limiting observations** that do not demonstrate resource exhaustion, financial impact, or abuse potential. +5. **Social engineering** — phishing, vishing, pretexting, or any form of social engineering targeting Daytona employees or users. +6. **Physical security testing** of offices, data centers, or personnel. +7. **Marketing and documentation sites** — findings against daytona.io or docs.daytona.io, excluding subdomain takeover vulnerabilities. +8. **Third-party services** — vulnerabilities in services or platforms not owned or operated by Daytona. +9. **Known public files or directories** — e.g., robots.txt, .well-known, or other intentionally public resources. +10. **DNSSEC or TLS cipher suite configuration suggestions** without a demonstrated exploit path. +11. **Missing Secure/HTTPOnly flags** on non-sensitive cookies. +12. **CSRF on unauthenticated or public-facing forms.** +13. **Outdated browsers and platforms** — vulnerabilities only affecting unpatched or end-of-life software. +14. **Automated scan output** — reports generated solely by automated tools without validated proof of impact. +15. **Best practice recommendations** without demonstrable security impact. +16. **Spam or service degradation** — testing that results in sending unsolicited messages or degradation of service to other users. + +## Supported Versions + +We accept vulnerability reports for the latest stable release of Daytona. + +## Safe Harbor + +Daytona supports safe harbor for security researchers who act in good faith and in accordance with this policy. + +We will not pursue legal action against researchers who: + +- Make a good-faith effort to avoid privacy violations, data destruction, and service disruption +- Only access data to the extent necessary to demonstrate the vulnerability +- Do not exfiltrate, retain, or disclose any user data encountered during research +- Report findings promptly through the channels listed above +- Do not disclose findings publicly before coordinated resolution (see Disclosure Timeline below) +- Comply with all applicable laws + +If legal action is initiated by a third party against a researcher for activities conducted in accordance with this policy, we will take steps to make it known that the research was authorized. + +This safe harbor applies to all Daytona services and assets listed in the Scope section. + +## Disclosure Timeline + +We follow a coordinated disclosure process: + +- **90 days** — We target remediation within 90 days of a validated report. Complex issues may require additional time, and we will communicate timelines transparently. +- **30 days post-patch** — After a fix is released, we ask that researchers wait 30 days before public disclosure to allow users to update. +- **No response** — If we fail to acknowledge or respond to a report within 90 days, the researcher may proceed with public disclosure after providing 14 days advance written notice to security@daytona.io. + +## Rewards + +We offer rewards from $100 to $1,000 for valid, original findings that demonstrate real security impact. Severity, exploitability, and report quality are all considered. Duplicate reports are credited to the first submission.