chore: add CLA + DCO enforcement and community health files

.github/CODEOWNERS

@@ -0,0 +1,25 @@
+# CODEOWNERS -- Daytona Integrations
+# Listed owners are automatically requested for review on PRs that modify the
+# matching files. Multiple owners = OR semantics (any one can approve).
+
+# Security and compliance policies
+SECURITY.md                 @mislavivanda @aprojic
+CODE_OF_CONDUCT.md          @mislavivanda @aprojic
+
+# Contributor License Agreement (legal)
+CLA.md                      @mislavivanda @aprojic
+
+# Licensing and copyright
+LICENSE                     @mislavivanda @aprojic
+COPYRIGHT                   @mislavivanda @aprojic
+NOTICE                      @mislavivanda @aprojic
+
+# CI/CD workflows
+.github/workflows/          @mislavivanda
+
+# CLA/DCO enforcement (compliance controls)
+.github/workflows/cla.yml   @mislavivanda @aprojic
+.github/workflows/dco.yml   @mislavivanda @aprojic
+
+# CODEOWNERS itself (must protect itself)
+.github/CODEOWNERS          @mislavivanda @aprojic

.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,38 @@
+---
+name: Bug report
+about: Create a report to help us improve
+title: ''
+type: Bug
+assignees: ''
+---
+
+**Describe the bug**
+A clear and concise description of what the bug is.
+
+**Which package or app?**
+The integration this affects, e.g. `packages/pi-extension`, `packages/adk-plugin`, or
+`apps/dify-plugin`.
+
+**To Reproduce**
+Steps to reproduce the behavior:
+
+1. Use these parameters '...'
+2. Click on '...'
+3. Execute the following command '...'
+4. See error
+
+**Expected behavior**
+A clear and concise description of what you expected to happen.
+
+**Screenshots**
+If applicable, add screenshots to help explain your problem.
+
+**Environment (please provide what's relevant):**
+
+- Package/app + version: [e.g. `@daytona/pi` v0.0.1, `daytona-adk` v0.0.1]
+- Daytona SDK version: [e.g. `daytona` 0.x]
+- Runtime: [e.g. Node.js 20.x / Python 3.12]
+- OS: [e.g. macOS 14, Ubuntu 24.04]
+
+**Additional context**
+Add any other context about the problem here.

.github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,31 @@
+---
+name: Feature request
+about: Propose a new integration or an improvement to an existing one
+title: ''
+type: Feature
+assignees: ''
+---
+
+**What kind of request is this?**
+
+- [ ] A **new** integration, plugin, or tool
+- [ ] A **feature or improvement** for an existing package/app
+
+**Which integration?**
+For an existing one, name the package/app (e.g. `packages/pi-extension`, `apps/dify-plugin`).
+For a new one, name the platform or tool you'd like Daytona to integrate with (e.g. n8n,
+LangChain, a coding agent framework).
+
+**What problem does it solve?**
+A clear and concise description of the problem or use case. Ex. "When using Daytona with
+[...], I can't [...]"
+
+**Describe the solution you'd like**
+What should the integration do? Include the key capabilities, tools, or commands it should
+expose.
+
+**Describe alternatives you've considered**
+Any alternative solutions, existing workarounds, or other tools you've considered.
+
+**Additional context**
+Links to the target platform's docs/API, screenshots, or any other context.

.github/pull_request_template.md

@@ -0,0 +1,31 @@
+## Description
+
+Summarize the change and its motivation. List any dependencies this change requires.
+
+## Related issue(s)
+
+<!-- e.g. "Closes #123" -->
+
+## Scope
+
+- [ ] This PR touches **no more than one package/app** (release routing is by changed file path).
+- [ ] The **PR title** follows [Conventional Commits](https://www.conventionalcommits.org/)
+      (e.g. `feat(pi-extension): ...`, `fix(adk-plugin): ...`) — it becomes the squash-commit
+      message that release-please reads.
+
+## Checks
+
+- [ ] I ran the affected package's lint/build/test locally and they pass.
+- [ ] I updated documentation where relevant.
+
+## Legal
+
+- [ ] Every commit is **signed off** for the
+      [DCO](https://developercertificate.org/) (`git commit -s`); the sign-off matches the
+      commit author.
+- [ ] I agree to the
+      [Contributor License Agreement](https://github.com/daytona/integrations/blob/main/CLA.md).
+      On my first PR, the CLA assistant will comment and I will reply to sign (once).
+
+See [CONTRIBUTING.md](https://github.com/daytona/integrations/blob/main/CONTRIBUTING.md) for
+details.

.github/workflows/cla.yml

@@ -0,0 +1,70 @@
+name: '[PR] CLA Assistant'
+
+on:
+  issue_comment:
+    types: [created]
+  pull_request_target:
+    types: [opened, closed, synchronize]
+
+# Least-privilege token. `pull_request_target` runs in the BASE repo context so
+# that PRs from forks can still write the signature file and set the status
+# check. This job must ONLY run the trusted CLA action -- never check out or
+# execute the PR head's code here.
+permissions:
+  actions: write # re-run the check via the rerun API
+  contents: write # commit the signature file to the signatures branch
+  pull-requests: write # post / refresh the CLA comment
+  statuses: write # set the pass/fail commit status that gates merge
+
+# Serialize CLA runs repo-wide: every PR writes the same signatures branch/file,
+# so concurrent signatures could otherwise race and lose a write. Queue, don't
+# cancel, so no signature is dropped.
+concurrency:
+  group: cla-signatures
+  cancel-in-progress: false
+
+jobs:
+  cla-assistant:
+    name: CLA signed
+    runs-on: ubuntu-latest
+    steps:
+      - name: CLA Assistant
+        if: >-
+          (github.event_name == 'issue_comment' &&
+           github.event.issue.pull_request != null &&
+           (github.event.comment.body == 'recheck' ||
+            github.event.comment.body == 'I have read the CLA Document and I hereby sign the CLA')) ||
+          (github.event_name == 'pull_request_target' &&
+           (github.event.action != 'closed' || github.event.pull_request.merged == true))
+        # contributor-assistant/github-action v2.6.1 (upstream archived -- pin by SHA)
+        uses: contributor-assistant/github-action@ca4a40a7d1004f18d9960b404b97e5f30a505a08
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        with:
+          # Where signatures are stored, committed to `branch` below. That branch
+          # may be protected against force-pushes and deletions, but must NOT
+          # restrict who can push, require pull requests, or be locked -- the
+          # default GITHUB_TOKEN pushes normal signature commits directly to it.
+          path-to-signatures: 'signatures/version1/cla.json'
+          branch: 'cla-signatures'
+          # The document contributors are agreeing to.
+          path-to-document: 'https://github.com/daytona/integrations/blob/main/CLA.md'
+          # Bots and automation cannot sign -- exempt them. Explicit logins only:
+          # a `bot*` wildcard would let a human register a matching username
+          # (e.g. "bottle") and bypass the CLA gate.
+          allowlist: 'dependabot[bot],renovate[bot],github-actions[bot]'
+          # Lock the PR conversation after merge so a signature comment can't be
+          # deleted/revoked after the fact.
+          lock-pullrequest-aftermerge: true
+          custom-notsigned-prcomment: >-
+            Thank you for your contribution! Before we can merge it, we need you
+            to sign the [Daytona Contributor License Agreement](https://github.com/daytona/integrations/blob/main/CLA.md).
+            You only need to do this once, and it will cover all of your future
+            contributions to this repository. If you are signing on behalf of an
+            entity (for example, your employer), please also reply with the
+            entity's legal name and your role or title, and confirm that you are
+            authorized to bind it. Please read the CLA and, if you agree, post the
+            following comment on this PR:
+          custom-pr-sign-comment: 'I have read the CLA Document and I hereby sign the CLA'
+          custom-allsigned-prcomment: >-
+            All contributors have signed the CLA. ✅ Thank you!

.github/workflows/dco.yml

@@ -0,0 +1,92 @@
+# Developer Certificate of Origin (DCO) enforcement.
+#
+# Every non-merge commit in a pull request must carry a `Signed-off-by:` trailer
+# whose email matches the commit author, certifying the DCO v1.1
+# (https://developercertificate.org/). Contributors add it with `git commit -s`.
+#
+# Self-contained: reads the PR's commits via the API and validates each sign-off
+# (no external app/action to install). Runs on `pull_request` with a read-only
+# token, so it is safe for fork PRs. The `DCO` job is the stable status to
+# require in branch protection.
+
+name: dco
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened]
+
+permissions:
+  contents: read
+  pull-requests: read
+
+jobs:
+  dco:
+    name: DCO
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check Signed-off-by on every commit
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PR: ${{ github.event.pull_request.number }}
+          REPO: ${{ github.repository }}
+          # Bots and automation cannot sign off -- exempt them. Explicit logins only.
+          ALLOWLIST: 'dependabot[bot],renovate[bot],github-actions[bot]'
+        run: |
+          set -euo pipefail
+
+          # Authoritative commit list for this PR (works for forks). --slurp wraps
+          # each page as an array element; `add` flattens them into one array.
+          commits=$(gh api --paginate --slurp "repos/$REPO/pulls/$PR/commits" | jq 'add')
+          len=$(jq 'length' <<<"$commits")
+          echo "Checking $len commit(s) in PR #$PR"
+
+          fail=0
+          for i in $(seq 0 $((len - 1))); do
+            sha=$(jq -r ".[$i].sha" <<<"$commits")
+            short=${sha:0:7}
+
+            # Skip merge commits (2+ parents): they carry no authored content.
+            if [ "$(jq -r ".[$i].parents | length" <<<"$commits")" -ge 2 ]; then
+              echo "skip $short (merge commit)"
+              continue
+            fi
+
+            # Skip allowlisted bot authors (they cannot add a sign-off). `.author.login`
+            # is GitHub's resolution of the commit to a real account (null if the email
+            # isn't linked), so it can't be forged by setting an arbitrary git author.
+            login=$(jq -r ".[$i].author.login // \"\"" <<<"$commits")
+            case ",$ALLOWLIST," in
+              *",$login,"*) echo "skip $short (allowlisted: $login)"; continue ;;
+            esac
+
+            author_email=$(jq -r ".[$i].commit.author.email" <<<"$commits" | tr '[:upper:]' '[:lower:]')
+            message=$(jq -r ".[$i].commit.message" <<<"$commits")
+
+            # Extract sign-off emails from the actual trailer block only, via
+            # `git interpret-trailers` -- a loose "Signed-off-by:" line elsewhere in
+            # the body must NOT count (case-insensitive email match).
+            signoff_emails=$(printf '%s\n' "$message" \
+              | git interpret-trailers --parse \
+              | grep -iE '^Signed-off-by:[[:space:]]*.+<.+>' \
+              | sed -E 's/.*<([^>]+)>.*/\1/' \
+              | tr '[:upper:]' '[:lower:]' || true)
+
+            if printf '%s\n' "$signoff_emails" | grep -qxF "$author_email"; then
+              echo "ok   $short ($author_email)"
+            else
+              echo "FAIL $short: no 'Signed-off-by:' matching author <$author_email>"
+              fail=1
+            fi
+          done
+
+          if [ "$fail" -ne 0 ]; then
+            echo ""
+            echo "::error::One or more commits are missing a matching DCO sign-off."
+            echo "Add one to each commit, then push again:"
+            echo "  - new commits:      git commit -s"
+            echo "  - existing commits: git rebase --signoff <base-branch> && git push --force-with-lease"
+            echo "The sign-off email must match the commit author. See CONTRIBUTING.md"
+            echo "and https://developercertificate.org/."
+            exit 1
+          fi
+          echo "All commits carry a valid DCO sign-off."