From 66c0d9e9ecf69c3dc6fe11937937f2506abc5d9d Mon Sep 17 00:00:00 2001 From: Mislav Ivanda Date: Tue, 14 Jul 2026 15:11:16 +0200 Subject: [PATCH 1/4] chore: add CLA + DCO enforcement and community health files Signed-off-by: Mislav Ivanda --- .github/CODEOWNERS | 21 +++ .github/ISSUE_TEMPLATE/bug_report.md | 38 +++++ .github/ISSUE_TEMPLATE/feature_request.md | 31 ++++ .github/pull_request_template.md | 31 ++++ .github/workflows/cla.yml | 62 ++++++++ .github/workflows/dco.yml | 87 +++++++++++ CLA.md | 177 ++++++++++++++++++++++ CODE_OF_CONDUCT.md | 133 ++++++++++++++++ CONTRIBUTING.md | 75 +++++++++ COPYRIGHT | 18 +++ NOTICE | 5 + SECURITY.md | 85 +++++++++++ 12 files changed, 763 insertions(+) create mode 100644 .github/CODEOWNERS create mode 100644 .github/ISSUE_TEMPLATE/bug_report.md create mode 100644 .github/ISSUE_TEMPLATE/feature_request.md create mode 100644 .github/pull_request_template.md create mode 100644 .github/workflows/cla.yml create mode 100644 .github/workflows/dco.yml create mode 100644 CLA.md create mode 100644 CODE_OF_CONDUCT.md create mode 100644 CONTRIBUTING.md create mode 100644 COPYRIGHT create mode 100644 NOTICE create mode 100644 SECURITY.md diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS new file mode 100644 index 0000000..35adcf8 --- /dev/null +++ b/.github/CODEOWNERS @@ -0,0 +1,21 @@ +# CODEOWNERS -- Daytona Integrations +# Listed owners are automatically requested for review on PRs that modify the +# matching files. Multiple owners = OR semantics (any one can approve). + +# Security and compliance policies +SECURITY.md @mislavivanda +CODE_OF_CONDUCT.md @mislavivanda + +# Contributor License Agreement (legal) +CLA.md @mislavivanda + +# Licensing and copyright +LICENSE @mislavivanda +COPYRIGHT @mislavivanda +NOTICE @mislavivanda + +# CI/CD workflows (includes the CLA and DCO enforcement) +.github/workflows/ @mislavivanda + +# CODEOWNERS itself (must protect itself) +.github/CODEOWNERS @mislavivanda diff --git a/.github/ISSUE_TEMPLATE/bug_report.md b/.github/ISSUE_TEMPLATE/bug_report.md new file mode 100644 index 0000000..4d3ba0d --- /dev/null +++ b/.github/ISSUE_TEMPLATE/bug_report.md @@ -0,0 +1,38 @@ +--- +name: Bug report +about: Create a report to help us improve +title: '' +type: Bug +assignees: '' +--- + +**Describe the bug** +A clear and concise description of what the bug is. + +**Which package or app?** +The integration this affects, e.g. `packages/pi-extension`, `packages/adk-plugin`, or +`apps/dify-plugin`. + +**To Reproduce** +Steps to reproduce the behavior: + +1. Use these parameters '...' +2. Click on '...' +3. Execute the following command '...' +4. See error + +**Expected behavior** +A clear and concise description of what you expected to happen. + +**Screenshots** +If applicable, add screenshots to help explain your problem. + +**Environment (required fields):** + +- Package/app + version: [e.g. `@daytona/pi` v0.0.1, `daytona-adk` v0.0.1] +- Daytona SDK version: [e.g. `daytona` 0.x] +- Runtime: [e.g. Node.js 20.x / Python 3.12] +- OS: [e.g. macOS 14, Ubuntu 24.04] + +**Additional context** +Add any other context about the problem here. diff --git a/.github/ISSUE_TEMPLATE/feature_request.md b/.github/ISSUE_TEMPLATE/feature_request.md new file mode 100644 index 0000000..db02b39 --- /dev/null +++ b/.github/ISSUE_TEMPLATE/feature_request.md @@ -0,0 +1,31 @@ +--- +name: Feature request +about: Propose a new integration or an improvement to an existing one +title: '' +type: Feature +assignees: '' +--- + +**What kind of request is this?** + +- [ ] A **new** integration, plugin, or tool +- [ ] A **feature or improvement** for an existing package/app + +**Which integration?** +For an existing one, name the package/app (e.g. `packages/pi-extension`, `apps/dify-plugin`). +For a new one, name the platform or tool you'd like Daytona to integrate with (e.g. n8n, +LangChain, a coding agent framework). + +**What problem does it solve?** +A clear and concise description of the problem or use case. Ex. "When using Daytona with +[...], I can't [...]" + +**Describe the solution you'd like** +What should the integration do? Include the key capabilities, tools, or commands it should +expose. + +**Describe alternatives you've considered** +Any alternative solutions, existing workarounds, or other tools you've considered. + +**Additional context** +Links to the target platform's docs/API, screenshots, or any other context. diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md new file mode 100644 index 0000000..3bb75e9 --- /dev/null +++ b/.github/pull_request_template.md @@ -0,0 +1,31 @@ +## Description + +Summarize the change and its motivation. List any dependencies this change requires. + +## Related issue(s) + + + +## Scope + +- [ ] This PR touches **only one package/app** (release routing is by changed file path). +- [ ] The **PR title** follows [Conventional Commits](https://www.conventionalcommits.org/) + (e.g. `feat(pi-extension): ...`, `fix(adk-plugin): ...`) — it becomes the squash-commit + message that release-please reads. + +## Checks + +- [ ] I ran the affected package's lint/build/test locally and they pass. +- [ ] I updated documentation where relevant. + +## Legal + +- [ ] Every commit is **signed off** for the + [DCO](https://developercertificate.org/) (`git commit -s`); the sign-off matches the + commit author. +- [ ] I agree to the + [Contributor License Agreement](https://github.com/daytona/integrations/blob/main/CLA.md). + On my first PR, the CLA assistant will comment and I will reply to sign (once). + +See [CONTRIBUTING.md](https://github.com/daytona/integrations/blob/main/CONTRIBUTING.md) for +details. diff --git a/.github/workflows/cla.yml b/.github/workflows/cla.yml new file mode 100644 index 0000000..c068590 --- /dev/null +++ b/.github/workflows/cla.yml @@ -0,0 +1,62 @@ +name: '[PR] CLA Assistant' + +on: + issue_comment: + types: [created] + pull_request_target: + types: [opened, closed, synchronize] + +# Least-privilege token. `pull_request_target` runs in the BASE repo context so +# that PRs from forks can still write the signature file and set the status +# check. This job must ONLY run the trusted CLA action -- never check out or +# execute the PR head's code here. +permissions: + actions: write # re-run the check via the rerun API + contents: write # commit the signature file to the signatures branch + pull-requests: write # post / refresh the CLA comment + statuses: write # set the pass/fail commit status that gates merge + +jobs: + cla-assistant: + name: CLA signed + runs-on: ubuntu-latest + steps: + - name: CLA Assistant + if: >- + (github.event_name == 'issue_comment' && + github.event.issue.pull_request != null && + (github.event.comment.body == 'recheck' || + github.event.comment.body == 'I have read the CLA Document and I hereby sign the CLA')) || + github.event_name == 'pull_request_target' + # contributor-assistant/github-action v2.6.1 (upstream archived -- pin by SHA) + uses: contributor-assistant/github-action@ca4a40a7d1004f18d9960b404b97e5f30a505a08 + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + with: + # Where signatures are stored, committed to `branch` below. That branch + # may be protected against force-pushes and deletions, but must NOT + # restrict who can push, require pull requests, or be locked -- the + # default GITHUB_TOKEN pushes normal signature commits directly to it. + path-to-signatures: 'signatures/version1/cla.json' + branch: 'cla-signatures' + # The document contributors are agreeing to. + path-to-document: 'https://github.com/daytona/integrations/blob/main/CLA.md' + # Bots and automation cannot sign -- exempt them. Explicit logins only: + # a `bot*` wildcard would let a human register a matching username + # (e.g. "bottle") and bypass the CLA gate. + allowlist: 'dependabot[bot],renovate[bot],github-actions[bot]' + # Lock the PR conversation after merge so a signature comment can't be + # deleted/revoked after the fact. + lock-pullrequest-aftermerge: true + custom-notsigned-prcomment: >- + Thank you for your contribution! Before we can merge it, we need you + to sign the [Daytona Contributor License Agreement](https://github.com/daytona/integrations/blob/main/CLA.md). + You only need to do this once, and it will cover all of your future + contributions to this repository. If you are signing on behalf of an + entity (for example, your employer), please also reply with the + entity's legal name and your role or title, and confirm that you are + authorized to bind it. Please read the CLA and, if you agree, post the + following comment on this PR: + custom-pr-sign-comment: 'I have read the CLA Document and I hereby sign the CLA' + custom-allsigned-prcomment: >- + All contributors have signed the CLA. ✅ Thank you! diff --git a/.github/workflows/dco.yml b/.github/workflows/dco.yml new file mode 100644 index 0000000..ab3cacb --- /dev/null +++ b/.github/workflows/dco.yml @@ -0,0 +1,87 @@ +# Developer Certificate of Origin (DCO) enforcement. +# +# Every non-merge commit in a pull request must carry a `Signed-off-by:` trailer +# whose email matches the commit author, certifying the DCO v1.1 +# (https://developercertificate.org/). Contributors add it with `git commit -s`. +# +# Self-contained: reads the PR's commits via the API and validates each sign-off +# (no external app/action to install). Runs on `pull_request` with a read-only +# token, so it is safe for fork PRs. The `DCO` job is the stable status to +# require in branch protection. + +name: dco + +on: + pull_request: + types: [opened, synchronize, reopened] + +permissions: + contents: read + pull-requests: read + +jobs: + dco: + name: DCO + runs-on: ubuntu-latest + steps: + - name: Check Signed-off-by on every commit + env: + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + PR: ${{ github.event.pull_request.number }} + REPO: ${{ github.repository }} + # Bots and automation cannot sign off -- exempt them. Explicit logins only. + ALLOWLIST: 'dependabot[bot],renovate[bot],github-actions[bot]' + run: | + set -euo pipefail + + # Authoritative commit list for this PR (works for forks). --slurp wraps + # each page as an array element; `add` flattens them into one array. + commits=$(gh api --paginate --slurp "repos/$REPO/pulls/$PR/commits" | jq 'add') + len=$(jq 'length' <<<"$commits") + echo "Checking $len commit(s) in PR #$PR" + + fail=0 + for i in $(seq 0 $((len - 1))); do + sha=$(jq -r ".[$i].sha" <<<"$commits") + short=${sha:0:7} + + # Skip merge commits (2+ parents): they carry no authored content. + if [ "$(jq -r ".[$i].parents | length" <<<"$commits")" -ge 2 ]; then + echo "skip $short (merge commit)" + continue + fi + + # Skip allowlisted bot authors (they cannot add a sign-off). + login=$(jq -r ".[$i].author.login // \"\"" <<<"$commits") + case ",$ALLOWLIST," in + *",$login,"*) echo "skip $short (allowlisted: $login)"; continue ;; + esac + + author_email=$(jq -r ".[$i].commit.author.email" <<<"$commits" | tr '[:upper:]' '[:lower:]') + message=$(jq -r ".[$i].commit.message" <<<"$commits") + + # Collect the email from every `Signed-off-by:` trailer (case-insensitive). + signoff_emails=$(printf '%s\n' "$message" \ + | grep -iE '^[[:space:]]*Signed-off-by:[[:space:]]*.+<.+>' \ + | sed -E 's/.*<([^>]+)>.*/\1/' \ + | tr '[:upper:]' '[:lower:]' || true) + + if printf '%s\n' "$signoff_emails" | grep -qxF "$author_email"; then + echo "ok $short ($author_email)" + else + echo "FAIL $short: no 'Signed-off-by:' matching author <$author_email>" + fail=1 + fi + done + + if [ "$fail" -ne 0 ]; then + echo "" + echo "::error::One or more commits are missing a matching DCO sign-off." + echo "Add one to each commit, then push again:" + echo " - new commits: git commit -s" + echo " - existing commits: git rebase --signoff && git push --force-with-lease" + echo "The sign-off email must match the commit author. See CONTRIBUTING.md" + echo "and https://developercertificate.org/." + exit 1 + fi + echo "All commits carry a valid DCO sign-off." diff --git a/CLA.md b/CLA.md new file mode 100644 index 0000000..d027bbd --- /dev/null +++ b/CLA.md @@ -0,0 +1,177 @@ +# Daytona Contributor License Agreement ("Agreement") + +Thank you for your interest in Daytona Platforms, Inc. ("Daytona", "We", or +"Us"). This Agreement documents the rights granted to Us by contributors, whether +You are an individual contributing on Your own behalf or a legal entity (such as +a company) contributing through Your employees or agents. This is a legally +binding document, so please read it carefully before agreeing to it. + +> **How to sign.** You accept this Agreement electronically through our CLA +> assistant. When you open your first pull request to the `daytona/integrations` +> repository, the CLA assistant will comment with a link to this Agreement and +> ask you to confirm your acceptance by posting the exact comment it provides. By +> posting that comment, You affirmatively sign, and agree to be legally bound by, +> this Agreement. If You are accepting on behalf of an entity (for example, Your +> employer), by doing so You confirm that You are authorized to bind that entity +> to this Agreement. If accepting on behalf of an entity, You must identify the +> entity's legal name and Your role or title, or otherwise provide the information +> requested by the CLA assistant to confirm the entity on whose behalf You are +> accepting. Your GitHub identity and the date of your acceptance are recorded as +> your signature. This Agreement applies to the Contributions included in the pull +> request in which You accept this Agreement, and to all Contributions You Submit +> to Us after that acceptance. + +## 1. Definitions + +**"You"** (or **"Your"**) means the individual or legal entity that accepts this +Agreement. For a legal entity, the entity on whose behalf a Contribution is +Submitted is the Contributor, and the individual accepting this Agreement +represents that they are authorized to bind that entity to it. If the acceptance +record identifies an entity, "You" means that entity; otherwise, "You" means the +individual associated with the recorded GitHub account. + +**"Contribution"** means any original work of authorship, including any +modifications or additions to an existing work, that is Submitted by You to Us in +which You own or assert ownership of the Copyright. + +**"Copyright"** means all rights protecting works of authorship, including +copyright, moral, and neighboring rights, as appropriate, for the full term of +their existence. + +**"Submit"** means any form of electronic, verbal, or written communication sent +to Us or Our representatives, including but not limited to communication on +electronic mailing lists, source code control systems, and issue tracking +systems that are managed by, or on behalf of, Us for the purpose of discussing +and improving the Material, but excluding communication that is conspicuously +marked or otherwise designated in writing by You as "Not a Contribution." + +**"Material"** means the software project owned or managed by Us to which a +Contribution is Submitted, specifically the `daytona/integrations` repository. + +## 2. Scope and Consideration + +This Agreement applies to the Contributions included in the pull request in which +You accept this Agreement, and to all Contributions You Submit to Us after that +acceptance. You grant the rights set out in this Agreement in consideration of, +and as a condition of, the opportunity to participate in the Material and to have +Your Contributions considered for inclusion in it. No monetary or other payment +is or will be owed to You for Your Contributions or for entering into this +Agreement. The representations in Section 6 apply to each Contribution You Submit, +whether on Your own behalf or on behalf of an entity. + +## 3. Grant of Copyright License + +Subject to the terms of this Agreement, You hereby grant to Us and to recipients +of software distributed by Us a perpetual, worldwide, non-exclusive, no-charge, +royalty-free, irrevocable license, with the right to sublicense to recipients of +software distributed by Us under terms We choose, under Your Copyright to +reproduce, prepare derivative works of, publicly display, publicly perform, +sublicense, and distribute Your Contributions and such derivative works. To the +maximum extent permitted by law, You waive and agree not to assert any moral +rights, neighboring rights, or similar rights in Your Contributions against Us, +Our sublicensees, or recipients of software distributed by Us. + +## 4. Grant of Patent License + +Subject to the terms of this Agreement, You hereby grant to Us and to recipients +of software distributed by Us a perpetual, worldwide, non-exclusive, no-charge, +royalty-free, irrevocable (except as stated in this section) patent license, with +the right to sublicense to recipients of software distributed by Us under terms +We choose, to make, have made, use, offer to sell, sell, import, and otherwise +transfer the Material, where such license applies only to those patent claims +licensable by You that are necessarily infringed by Your Contribution(s) alone or +by combination of Your Contribution(s) with the Material to which such +Contribution(s) was Submitted. If any entity institutes patent litigation +against You or any other entity (including a cross-claim or counterclaim in a +lawsuit) alleging that Your Contribution, or the Material to which You have +contributed, constitutes direct or contributory patent infringement, then any +patent licenses granted to that entity under this Agreement for that Contribution +or Material shall terminate as of the date such litigation is filed. + +## 5. Outbound License (Relicensing Rights) + +Based on the grant of rights in Sections 3 and 4, We may license the Contribution +under any license terms We choose, including copyleft, permissive, commercial, +and proprietary licenses. You acknowledge that We currently distribute the +Material under the Apache License 2.0 (with certain packages made available under +the MIT License, as indicated by the LICENSE file in the applicable directory), +and that We may, in addition, offer the Material and Your Contribution under +separate commercial or proprietary terms, and may change the license or the +visibility of the Material, for future versions, distributions, or releases, at +any time, in Our sole discretion and without further notice to, consent from, or +payment to You. Nothing in this Agreement requires Us to use Your Contribution in +any product or under any license. + +## 6. Your Representations + +You represent that: + +(a) You are legally entitled, and have the legal capacity, to enter into this +Agreement and grant the above licenses. If You are an individual and Your +employer(s) has rights to intellectual property that You create that includes +Your Contributions, You represent that You have received permission to make +Contributions on behalf of that employer, that Your employer has waived such +rights for Your Contributions to Us, that Your employer has authorized You to +accept this Agreement on its behalf, or that Your employer has otherwise entered +into a written or electronic agreement with Us covering such Contributions. + +(b) If You are, or are accepting this Agreement on behalf of, a legal entity, You +represent that You are authorized to enter into this Agreement on that entity's +behalf, that it binds the entity, and that it covers Contributions Submitted to +Us by the entity's employees and agents on its behalf, including Contributions +submitted through the GitHub account recorded in the CLA assistant acceptance +process. + +(c) Each of Your Contributions is Your original creation. + +(d) Your Contribution submissions include complete details of any third-party +license or other restriction (including, but not limited to, related patents and +trademarks) of which You are personally aware and which are associated with any +part of Your Contributions. + +## 7. Disclaimer + +You are not expected to provide support for Your Contributions, except to the +extent You desire to provide support. Unless required by applicable law or agreed +to in writing, You provide Your Contributions on an "AS IS" BASIS, WITHOUT +WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, +without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, +MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. + +## 8. Notice + +You agree to notify Us of any facts or circumstances of which You become aware +that would make these representations inaccurate in any respect. + +## 9. Miscellaneous + +This Agreement will be governed by the laws of the State of Massachusetts, +without regard to any provision of law that would require or permit the +application of the substantive law of any other jurisdiction. In the event of a +dispute, the federal or state courts located in Massachusetts shall have exclusive +jurisdiction. + +If any provision of this Agreement is, for any reason, held to be invalid or +unenforceable, the other provisions of this Agreement will remain enforceable and +the invalid or unenforceable provision will be deemed modified so that it is +valid and enforceable to the maximum extent permitted by law. Any waiver or +failure to enforce any provision of this Agreement on one occasion will not be +deemed a waiver of any other provision or of such provision on any other +occasion. + +Each party shall execute and deliver any and all additional papers, documents, +and other assurances, and shall do any and all acts and things reasonably +necessary in connection with the performance of its obligations under this +Agreement, to carry out the intent of this Agreement. + +This Agreement constitutes the entire agreement between the parties with respect +to Contributions Submitted through the electronic acceptance process described +above, and does not amend, replace, or supersede any separate written contributor, +including any previously executed individual contributor license agreements, or +corporate license agreement previously executed between You and Us, unless that +agreement expressly states otherwise. This Agreement may only be amended in a +writing signed by duly authorized representatives of the parties. + +This Agreement may be executed in one or more counterparts, or accepted +electronically, each of which shall be deemed an original, but all of which +together will constitute one instrument. diff --git a/CODE_OF_CONDUCT.md b/CODE_OF_CONDUCT.md new file mode 100644 index 0000000..8ac63bd --- /dev/null +++ b/CODE_OF_CONDUCT.md @@ -0,0 +1,133 @@ +# Contributor Covenant Code of Conduct + +## Our Pledge + +We as members, contributors, and leaders pledge to make participation in our +community a harassment-free experience for everyone, regardless of age, body +size, visible or invisible disability, ethnicity, sex characteristics, gender +identity and expression, level of experience, education, socio-economic status, +nationality, personal appearance, race, caste, color, religion, or sexual +identity and orientation. + +We pledge to act and interact in ways that contribute to an open, welcoming, +diverse, inclusive, and healthy community. + +## Our Standards + +Examples of behavior that contributes to a positive environment for our +community include: + +* Demonstrating empathy and kindness toward other people +* Being respectful of differing opinions, viewpoints, and experiences +* Giving and gracefully accepting constructive feedback +* Accepting responsibility and apologizing to those affected by our mistakes, + and learning from the experience +* Focusing on what is best not just for us as individuals, but for the overall + community + +Examples of unacceptable behavior include: + +* The use of sexualized language or imagery, and sexual attention or advances of + any kind +* Trolling, insulting or derogatory comments, and personal or political attacks +* Public or private harassment +* Publishing others' private information, such as a physical or email address, + without their explicit permission +* Other conduct which could reasonably be considered inappropriate in a + professional setting + +## Enforcement Responsibilities + +Community leaders are responsible for clarifying and enforcing our standards of +acceptable behavior and will take appropriate and fair corrective action in +response to any behavior that they deem inappropriate, threatening, offensive, +or harmful. + +Community leaders have the right and responsibility to remove, edit, or reject +comments, commits, code, wiki edits, issues, and other contributions that are +not aligned to this Code of Conduct, and will communicate reasons for moderation +decisions when appropriate. + +## Scope + +This Code of Conduct applies within all community spaces, and also applies when +an individual is officially representing the community in public spaces. +Examples of representing our community include using an official email address, +posting via an official social media account, or acting as an appointed +representative at an online or offline event. + +## Enforcement + +Instances of abusive, harassing, or otherwise unacceptable behavior may be +reported to the community leaders responsible for enforcement at +codeofconduct@daytona.io. + +All complaints will be reviewed and investigated promptly and fairly. + +All community leaders are obligated to respect the privacy and security of the +reporter of any incident. + +## Enforcement Guidelines + +Community leaders will follow these Community Impact Guidelines in determining +the consequences for any action they deem in violation of this Code of Conduct: + +### 1. Correction + +**Community Impact**: Use of inappropriate language or other behavior deemed +unprofessional or unwelcome in the community. + +**Consequence**: A private, written warning from community leaders, providing +clarity around the nature of the violation and an explanation of why the +behavior was inappropriate. A public apology may be requested. + +### 2. Warning + +**Community Impact**: A violation through a single incident or series of +actions. + +**Consequence**: A warning with consequences for continued behavior. No +interaction with the people involved, including unsolicited interaction with +those enforcing the Code of Conduct, for a specified period of time. This +includes avoiding interactions in community spaces as well as external channels +like social media. Violating these terms may lead to a temporary or permanent +ban. + +### 3. Temporary Ban + +**Community Impact**: A serious violation of community standards, including +sustained inappropriate behavior. + +**Consequence**: A temporary ban from any sort of interaction or public +communication with the community for a specified period of time. No public or +private interaction with the people involved, including unsolicited interaction +with those enforcing the Code of Conduct, is allowed during this period. +Violating these terms may lead to a permanent ban. + +### 4. Permanent Ban + +**Community Impact**: Demonstrating a pattern of violation of community +standards, including sustained inappropriate behavior, harassment of an +individual, or aggression toward or disparagement of classes of individuals. + +**Consequence**: A permanent ban from any sort of public interaction within the +community. + +## Attribution + +This Code of Conduct is adapted from the [Contributor Covenant][homepage], +version 2.1, available at +[https://www.contributor-covenant.org/version/2/1/code_of_conduct.html][v2.1]. + +Community Impact Guidelines were inspired by +[Mozilla's code of conduct enforcement ladder][Mozilla CoC]. + +For answers to common questions about this code of conduct, see the FAQ at +[https://www.contributor-covenant.org/faq][FAQ]. Translations are available at +[https://www.contributor-covenant.org/translations][translations]. + +[homepage]: https://www.contributor-covenant.org +[v2.1]: https://www.contributor-covenant.org/version/2/1/code_of_conduct.html +[Mozilla CoC]: https://github.com/mozilla/diversity +[FAQ]: https://www.contributor-covenant.org/faq +[translations]: https://www.contributor-covenant.org/translations diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md new file mode 100644 index 0000000..8fba44f --- /dev/null +++ b/CONTRIBUTING.md @@ -0,0 +1,75 @@ +# Contributing to Daytona Integrations + +This repository is a monorepo of community and partner **integrations, plugins, and tools** +for [Daytona](https://www.daytona.io). Each package in [`packages/`](packages/) and app in +[`apps/`](apps/) is versioned, released, and published independently. Contributions are +welcome! ❤️ + +> If you like the project but don't have time to contribute, you can still help by starring +> the repo, telling others about it, or referencing it in your own project's README. + +## Code of Conduct + +This project is governed by the [Daytona Code of Conduct](./CODE_OF_CONDUCT.md). By +participating, you are expected to uphold it. Please report unacceptable behavior to +[codeofconduct@daytona.io](mailto:codeofconduct@daytona.io). + +## Provide feedback + +Found a bug or have an idea? Please +[open an issue](https://github.com/daytona/integrations/issues/new) — but first check that a +matching issue doesn't already exist. + +## What you can contribute + +- Bug fixes and new features in an existing package under [`packages/`](packages/) or app + under [`apps/`](apps/). +- New integrations, plugins, or tools (please open an issue first to discuss the fit). +- Documentation improvements. + +## Submitting a pull request + +1. [Fork](https://help.github.com/articles/working-with-forks/) the repository and create a + branch for your change. +2. Keep each PR scoped to **one package** — release routing is by changed file path, not the + scope text. +3. PRs are **squash-merged**, so the **PR title must be a + [Conventional Commit](https://www.conventionalcommits.org/)** — e.g. + `feat(pi-extension): add X`, `fix(adk-plugin): handle Y`. That title becomes the squash + commit that [release-please](https://github.com/googleapis/release-please) reads to decide + the version bump and changelog. +4. **Sign off every commit** with `git commit -s` to comply with the DCO (see + [Licensing](#licensing)). +5. Develop within the package's own folder — each is self-contained, with its own lockfile, + dependencies, and `LICENSE`. Run that package's lint/build/test before opening the PR. +6. Open the pull request (a + [draft PR](https://help.github.com/en/articles/about-pull-requests#draft-pull-requests) is + welcome for early feedback). A Daytona team member will review it, and once approved and + green it will be merged into `main`. + +The first time you open a PR, our CLA assistant will also comment with a link to the +[Contributor License Agreement](./CLA.md) and a one-line instruction to sign it (see +[Licensing](#licensing)). + +## Licensing + +This repository is made available under [Apache-2.0](./LICENSE), unless a package declares +otherwise — each package includes its own `LICENSE` (a few are MIT). Contributing involves +two steps: + +1. **DCO sign-off (per commit).** Sign off every commit with `git commit -s` to certify, under + the [Developer Certificate of Origin](https://developercertificate.org/) v1.1, that you have + the right to submit the code. The sign-off name and email must match the commit author. A + DCO check runs on every pull request. + +2. **CLA signature (once).** You must also sign the + [Daytona Contributor License Agreement](./CLA.md) — it covers both individual and + entity/corporate contributors. You (or, for entity contributors, your organization) retain + copyright in your contributions, but you grant Daytona Platforms, Inc. a perpetual, + irrevocable, sublicensable license to them — **including the right to relicense and + redistribute the software under any terms (open source, proprietary, or closed source) and + to change the license or visibility of the project at any time.** A CLA assistant bot will + comment on your first pull request with a link and a one-line instruction to sign; a single + signature covers all your future contributions to this repository. + +Your PR cannot be merged until both the DCO check and the CLA check are green. diff --git a/COPYRIGHT b/COPYRIGHT new file mode 100644 index 0000000..40e07e3 --- /dev/null +++ b/COPYRIGHT @@ -0,0 +1,18 @@ +Copyrights in the Daytona software are retained by their respective +contributors. Contributors keep ownership of the copyright in their +contributions; no copyright assignment is required. + +By contributing, each contributor agrees to the Daytona Contributor License +Agreement (see CLA.md), under which they grant Daytona Platforms, Inc. a +perpetual, irrevocable, sublicensable license to their contributions. This +license includes the right for Daytona to relicense and redistribute the +software (and any contribution) under any terms of Daytona's choosing, +including proprietary or closed-source terms, and to change the license or +visibility of the software at any time. + +When we refer to the 'Daytona software authors', we mean anyone who has +contributed to this repository. + +Unless otherwise noted, such as with a LICENSE file in a directory, or a +specific copyright notice on a file, all files in this repository are currently +made available under the Apache 2.0 license. diff --git a/NOTICE b/NOTICE new file mode 100644 index 0000000..6fd231d --- /dev/null +++ b/NOTICE @@ -0,0 +1,5 @@ +Daytona +Copyright the various Daytona software authors. + +The initial developer of the software is Daytona Platforms, Inc. (https://daytona.io). +Copyright Daytona Platforms, Inc. All Rights Reserved. diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..dba4611 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,85 @@ +# Security Policy + +## Reporting a Vulnerability + +At Daytona, we take security seriously. If you believe you have found a security vulnerability in any Daytona-owned repository or service, please report it responsibly. + +**Please do NOT report security vulnerabilities through public GitHub issues.** + +Instead, please email us at: **security@daytona.io** + +You can also report vulnerabilities privately through [GitHub's security advisory feature](https://github.com/daytona/integrations/security/advisories/new). + +Please include: + +- Description of the vulnerability +- Steps to reproduce +- Impact assessment +- Any relevant screenshots or proof-of-concept + +We will acknowledge receipt within 2 business days and provide an initial assessment within 5 business days. + +## Scope + +The following assets and areas are in scope for vulnerability reports: + +- **Daytona platform** — app.daytona.io, including the web application and management interfaces +- **API and SDK** — all documented and undocumented API endpoints, client SDKs +- **Sandbox runtime isolation** — escape from sandbox to host, cross-tenant access, isolation boundary bypasses +- **Authentication and authorization** — SSO, API key management, session handling, privilege escalation across accounts or organizations +- **Secrets management** — scoped secret injection, unauthorized access to secrets, leakage across sandbox boundaries +- **Public GitHub repositories** — any repository under the [daytona](https://github.com/daytona) organization + +## Excluded Submission Types + +The following categories are excluded from this program. Reports in these categories will be closed without further assessment unless they demonstrate impact beyond what is described. + +1. **In-sandbox privilege escalation, root access, or capability use** — Daytona sandboxes provide full root access within user-namespace isolation by design. Findings that chain to host escape or cross-sandbox access remain in scope. +2. **Findings within the reporter's own sandbox** that do not demonstrate impact beyond that sandbox's isolation boundary. +3. **Denial of service** — DoS, DDoS, resource exhaustion, volumetric testing, or network flooding. +4. **Rate limiting observations** that do not demonstrate resource exhaustion, financial impact, or abuse potential. +5. **Social engineering** — phishing, vishing, pretexting, or any form of social engineering targeting Daytona employees or users. +6. **Physical security testing** of offices, data centers, or personnel. +7. **Marketing and documentation sites** — findings against daytona.io or docs.daytona.io, excluding subdomain takeover vulnerabilities. +8. **Third-party services** — vulnerabilities in services or platforms not owned or operated by Daytona. +9. **Known public files or directories** — e.g., robots.txt, .well-known, or other intentionally public resources. +10. **DNSSEC or TLS cipher suite configuration suggestions** without a demonstrated exploit path. +11. **Missing Secure/HTTPOnly flags** on non-sensitive cookies. +12. **CSRF on unauthenticated or public-facing forms.** +13. **Outdated browsers and platforms** — vulnerabilities only affecting unpatched or end-of-life software. +14. **Automated scan output** — reports generated solely by automated tools without validated proof of impact. +15. **Best practice recommendations** without demonstrable security impact. +16. **Spam or service degradation** — testing that results in sending unsolicited messages or degradation of service to other users. + +## Supported Versions + +We accept vulnerability reports for the latest stable release of Daytona. + +## Safe Harbor + +Daytona supports safe harbor for security researchers who act in good faith and in accordance with this policy. + +We will not pursue legal action against researchers who: + +- Make a good-faith effort to avoid privacy violations, data destruction, and service disruption +- Only access data to the extent necessary to demonstrate the vulnerability +- Do not exfiltrate, retain, or disclose any user data encountered during research +- Report findings promptly through the channels listed above +- Do not disclose findings publicly before coordinated resolution (see Disclosure Timeline below) +- Comply with all applicable laws + +If legal action is initiated by a third party against a researcher for activities conducted in accordance with this policy, we will take steps to make it known that the research was authorized. + +This safe harbor applies to all Daytona services and assets listed in the Scope section. + +## Disclosure Timeline + +We follow a coordinated disclosure process: + +- **90 days** — We target remediation within 90 days of a validated report. Complex issues may require additional time, and we will communicate timelines transparently. +- **30 days post-patch** — After a fix is released, we ask that researchers wait 30 days before public disclosure to allow users to update. +- **No response** — If we fail to acknowledge or respond to a report within 90 days, the researcher may proceed with public disclosure after providing 14 days advance written notice to security@daytona.io. + +## Rewards + +We offer rewards from $100 to $1,000 for valid, original findings that demonstrate real security impact. Severity, exploitability, and report quality are all considered. Duplicate reports are credited to the first submission. From bf3ff71665a32da7d47947213c415e5bab96274d Mon Sep 17 00:00:00 2001 From: Mislav Ivanda Date: Tue, 14 Jul 2026 15:42:18 +0200 Subject: [PATCH 2/4] chore: address PR review feedback - dco.yml: parse sign-offs with `git interpret-trailers` so a loose "Signed-off-by:" line outside the trailer block no longer counts; clarify the bot allowlist uses GitHub's resolved author login (not forgeable). - cla.yml: add a repo-wide concurrency group so concurrent signatures don't race on the shared signatures file; don't lock a PR that is closed unmerged (lock only after merge). - CONTRIBUTING.md: apps aren't published to a registry; scope PRs to one package or app; "dependency manifest" not lockfile; DCO matches author email. - PR/issue templates: "no more than one package/app"; environment details are requested, not enforceable in a Markdown template. Signed-off-by: Mislav Ivanda --- .github/ISSUE_TEMPLATE/bug_report.md | 2 +- .github/pull_request_template.md | 2 +- .github/workflows/cla.yml | 10 +++++++++- .github/workflows/dco.yml | 11 ++++++++--- CONTRIBUTING.md | 16 ++++++++-------- 5 files changed, 27 insertions(+), 14 deletions(-) diff --git a/.github/ISSUE_TEMPLATE/bug_report.md b/.github/ISSUE_TEMPLATE/bug_report.md index 4d3ba0d..6482328 100644 --- a/.github/ISSUE_TEMPLATE/bug_report.md +++ b/.github/ISSUE_TEMPLATE/bug_report.md @@ -27,7 +27,7 @@ A clear and concise description of what you expected to happen. **Screenshots** If applicable, add screenshots to help explain your problem. -**Environment (required fields):** +**Environment (please provide what's relevant):** - Package/app + version: [e.g. `@daytona/pi` v0.0.1, `daytona-adk` v0.0.1] - Daytona SDK version: [e.g. `daytona` 0.x] diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md index 3bb75e9..5dd6441 100644 --- a/.github/pull_request_template.md +++ b/.github/pull_request_template.md @@ -8,7 +8,7 @@ Summarize the change and its motivation. List any dependencies this change requi ## Scope -- [ ] This PR touches **only one package/app** (release routing is by changed file path). +- [ ] This PR touches **no more than one package/app** (release routing is by changed file path). - [ ] The **PR title** follows [Conventional Commits](https://www.conventionalcommits.org/) (e.g. `feat(pi-extension): ...`, `fix(adk-plugin): ...`) — it becomes the squash-commit message that release-please reads. diff --git a/.github/workflows/cla.yml b/.github/workflows/cla.yml index c068590..1ab9dbb 100644 --- a/.github/workflows/cla.yml +++ b/.github/workflows/cla.yml @@ -16,6 +16,13 @@ permissions: pull-requests: write # post / refresh the CLA comment statuses: write # set the pass/fail commit status that gates merge +# Serialize CLA runs repo-wide: every PR writes the same signatures branch/file, +# so concurrent signatures could otherwise race and lose a write. Queue, don't +# cancel, so no signature is dropped. +concurrency: + group: cla-signatures + cancel-in-progress: false + jobs: cla-assistant: name: CLA signed @@ -27,7 +34,8 @@ jobs: github.event.issue.pull_request != null && (github.event.comment.body == 'recheck' || github.event.comment.body == 'I have read the CLA Document and I hereby sign the CLA')) || - github.event_name == 'pull_request_target' + (github.event_name == 'pull_request_target' && + (github.event.action != 'closed' || github.event.pull_request.merged == true)) # contributor-assistant/github-action v2.6.1 (upstream archived -- pin by SHA) uses: contributor-assistant/github-action@ca4a40a7d1004f18d9960b404b97e5f30a505a08 env: diff --git a/.github/workflows/dco.yml b/.github/workflows/dco.yml index ab3cacb..237e534 100644 --- a/.github/workflows/dco.yml +++ b/.github/workflows/dco.yml @@ -51,7 +51,9 @@ jobs: continue fi - # Skip allowlisted bot authors (they cannot add a sign-off). + # Skip allowlisted bot authors (they cannot add a sign-off). `.author.login` + # is GitHub's resolution of the commit to a real account (null if the email + # isn't linked), so it can't be forged by setting an arbitrary git author. login=$(jq -r ".[$i].author.login // \"\"" <<<"$commits") case ",$ALLOWLIST," in *",$login,"*) echo "skip $short (allowlisted: $login)"; continue ;; @@ -60,9 +62,12 @@ jobs: author_email=$(jq -r ".[$i].commit.author.email" <<<"$commits" | tr '[:upper:]' '[:lower:]') message=$(jq -r ".[$i].commit.message" <<<"$commits") - # Collect the email from every `Signed-off-by:` trailer (case-insensitive). + # Extract sign-off emails from the actual trailer block only, via + # `git interpret-trailers` -- a loose "Signed-off-by:" line elsewhere in + # the body must NOT count (case-insensitive email match). signoff_emails=$(printf '%s\n' "$message" \ - | grep -iE '^[[:space:]]*Signed-off-by:[[:space:]]*.+<.+>' \ + | git interpret-trailers --parse \ + | grep -iE '^Signed-off-by:[[:space:]]*.+<.+>' \ | sed -E 's/.*<([^>]+)>.*/\1/' \ | tr '[:upper:]' '[:lower:]' || true) diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 8fba44f..cba6e13 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -1,9 +1,9 @@ # Contributing to Daytona Integrations This repository is a monorepo of community and partner **integrations, plugins, and tools** -for [Daytona](https://www.daytona.io). Each package in [`packages/`](packages/) and app in -[`apps/`](apps/) is versioned, released, and published independently. Contributions are -welcome! ❤️ +for [Daytona](https://www.daytona.io). Each package in [`packages/`](packages/) is versioned, +released, and published independently; the apps in [`apps/`](apps/) are standalone projects +that aren't published to a registry. Contributions are welcome! ❤️ > If you like the project but don't have time to contribute, you can still help by starring > the repo, telling others about it, or referencing it in your own project's README. @@ -31,8 +31,8 @@ matching issue doesn't already exist. 1. [Fork](https://help.github.com/articles/working-with-forks/) the repository and create a branch for your change. -2. Keep each PR scoped to **one package** — release routing is by changed file path, not the - scope text. +2. Keep each PR scoped to **one package or app**. For packages, release routing is by changed + file path, not the scope text. 3. PRs are **squash-merged**, so the **PR title must be a [Conventional Commit](https://www.conventionalcommits.org/)** — e.g. `feat(pi-extension): add X`, `fix(adk-plugin): handle Y`. That title becomes the squash @@ -40,8 +40,8 @@ matching issue doesn't already exist. the version bump and changelog. 4. **Sign off every commit** with `git commit -s` to comply with the DCO (see [Licensing](#licensing)). -5. Develop within the package's own folder — each is self-contained, with its own lockfile, - dependencies, and `LICENSE`. Run that package's lint/build/test before opening the PR. +5. Develop within the package's own folder — each is self-contained, with its own dependency + manifest and `LICENSE`. Run that package's lint/build/test before opening the PR. 6. Open the pull request (a [draft PR](https://help.github.com/en/articles/about-pull-requests#draft-pull-requests) is welcome for early feedback). A Daytona team member will review it, and once approved and @@ -59,7 +59,7 @@ two steps: 1. **DCO sign-off (per commit).** Sign off every commit with `git commit -s` to certify, under the [Developer Certificate of Origin](https://developercertificate.org/) v1.1, that you have - the right to submit the code. The sign-off name and email must match the commit author. A + the right to submit the code. The sign-off email must match the commit author's email. A DCO check runs on every pull request. 2. **CLA signature (once).** You must also sign the From 8f9345ebaafcf53858383613818919e959f528a1 Mon Sep 17 00:00:00 2001 From: Mislav Ivanda Date: Tue, 14 Jul 2026 16:22:09 +0200 Subject: [PATCH 3/4] chore: align contributor PR-scope wording across docs Follow-up to review: use "no more than one package or app" in CONTRIBUTING.md (so docs/repo-wide PRs like this one are in-scope) and mirror it in README.md; also drop the "lockfile" wording in README in favor of "dependency manifest". Signed-off-by: Mislav Ivanda --- CONTRIBUTING.md | 4 ++-- README.md | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index cba6e13..327925b 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -31,8 +31,8 @@ matching issue doesn't already exist. 1. [Fork](https://help.github.com/articles/working-with-forks/) the repository and create a branch for your change. -2. Keep each PR scoped to **one package or app**. For packages, release routing is by changed - file path, not the scope text. +2. Keep each PR scoped to **no more than one package or app** (docs-only or repo-wide changes + are fine). For packages, release routing is by changed file path, not the scope text. 3. PRs are **squash-merged**, so the **PR title must be a [Conventional Commit](https://www.conventionalcommits.org/)** — e.g. `feat(pi-extension): add X`, `fix(adk-plugin): handle Y`. That title becomes the squash diff --git a/README.md b/README.md index 0932c68..b5517eb 100644 --- a/README.md +++ b/README.md @@ -34,8 +34,8 @@ Versioning is **per package**, automated with [release-please](https://github.co ## Contributing - PRs are **squash-merged**, so the **PR title must be a [Conventional Commit](https://www.conventionalcommits.org/)** — e.g. `feat(pi-extension): add X`, `fix(adk-plugin): handle Y`. `feat` → minor, `fix` → patch, `feat!` / `BREAKING CHANGE:` → major; `chore`/`docs`/`ci` → no release. -- Keep each PR scoped to **one package** — release routing is by changed file path, not the scope text. -- Each package is self-contained (its own lockfile and dependencies); develop within its folder. +- Keep each PR scoped to **no more than one package or app** — for packages, release routing is by changed file path, not the scope text. +- Each package/app is self-contained (its own dependency manifest); develop within its folder. ## License From 73d71ac5fb79962c70edf9d7285702fb769c4e85 Mon Sep 17 00:00:00 2001 From: Mislav Ivanda Date: Tue, 14 Jul 2026 17:38:58 +0200 Subject: [PATCH 4/4] chore(codeowners): add @aprojic (CISO) as co-owner of legal/security files Adds @aprojic alongside @mislavivanda for SECURITY.md, CODE_OF_CONDUCT.md, CLA.md, LICENSE, COPYRIGHT, NOTICE, the CLA/DCO enforcement workflows, and CODEOWNERS itself. General CI workflows stay with @mislavivanda to avoid pinging the CISO on routine CI changes. Signed-off-by: Mislav Ivanda --- .github/CODEOWNERS | 22 +++++++++++++--------- 1 file changed, 13 insertions(+), 9 deletions(-) diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS index 35adcf8..c96e675 100644 --- a/.github/CODEOWNERS +++ b/.github/CODEOWNERS @@ -3,19 +3,23 @@ # matching files. Multiple owners = OR semantics (any one can approve). # Security and compliance policies -SECURITY.md @mislavivanda -CODE_OF_CONDUCT.md @mislavivanda +SECURITY.md @mislavivanda @aprojic +CODE_OF_CONDUCT.md @mislavivanda @aprojic # Contributor License Agreement (legal) -CLA.md @mislavivanda +CLA.md @mislavivanda @aprojic # Licensing and copyright -LICENSE @mislavivanda -COPYRIGHT @mislavivanda -NOTICE @mislavivanda +LICENSE @mislavivanda @aprojic +COPYRIGHT @mislavivanda @aprojic +NOTICE @mislavivanda @aprojic -# CI/CD workflows (includes the CLA and DCO enforcement) -.github/workflows/ @mislavivanda +# CI/CD workflows +.github/workflows/ @mislavivanda + +# CLA/DCO enforcement (compliance controls) +.github/workflows/cla.yml @mislavivanda @aprojic +.github/workflows/dco.yml @mislavivanda @aprojic # CODEOWNERS itself (must protect itself) -.github/CODEOWNERS @mislavivanda +.github/CODEOWNERS @mislavivanda @aprojic