From 1113822eff2752512620823babe0332ef80974e3 Mon Sep 17 00:00:00 2001
From: asalaz <asalaz@jfrog.com>
Date: Thu, 9 Jul 2026 13:35:42 +0300
Subject: [PATCH] Add NOTICE and CLA workflow for OSS governance compliance

---
 .github/scripts/sync-skills.mjs |  5 +++++
 .github/workflows/cla.yml       | 29 +++++++++++++++++++++++++++++
 NOTICE                          | 23 +++++++++++++++++++++++
 3 files changed, 57 insertions(+)
 create mode 100644 .github/workflows/cla.yml
 create mode 100644 NOTICE

diff --git a/.github/scripts/sync-skills.mjs b/.github/scripts/sync-skills.mjs
index 51ec45c..00f06cb 100644
--- a/.github/scripts/sync-skills.mjs
+++ b/.github/scripts/sync-skills.mjs
@@ -1,4 +1,9 @@
 #!/usr/bin/env node
+
+// Copyright (c) JFrog Ltd. 2026
+// Licensed under the Apache License, Version 2.0
+// https://www.apache.org/licenses/LICENSE-2.0
+
 // Vendors skill content from the upstream jfrog/jfrog-skills repository
 // into this plugin. Run manually when bumping the pin: bump `pin` in
 // sync-skills-vendor.json, then run this
diff --git a/.github/workflows/cla.yml b/.github/workflows/cla.yml
new file mode 100644
index 0000000..5206431
--- /dev/null
+++ b/.github/workflows/cla.yml
@@ -0,0 +1,29 @@
+# Copyright (c) JFrog Ltd. 2026
+# Licensed under the Apache License, Version 2.0
+# https://www.apache.org/licenses/LICENSE-2.0
+
+name: "CLA Assistant"
+on:
+  # issue_comment triggers this action on each comment on issues and pull requests
+  issue_comment:
+    types: [ created ]
+  pull_request_target:
+    types: [ opened, synchronize ]
+permissions:
+  actions: write
+  contents: write
+  pull-requests: write
+  issues: write
+  statuses: write
+
+jobs:
+  CLAssistant:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Run CLA Check
+        uses: jfrog/.github/actions/cla@main
+        with:
+          event_comment_body: ${{ github.event.comment.body }}
+          event_name: ${{ github.event_name }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          CLA_SIGN_TOKEN: ${{ secrets.CLA_SIGN_TOKEN }}
diff --git a/NOTICE b/NOTICE
new file mode 100644
index 0000000..a99c5a3
--- /dev/null
+++ b/NOTICE
@@ -0,0 +1,23 @@
+NOTICE
+JFrog devin-plugin
+Copyright (c) 2026 JFrog Ltd.
+
+This product includes software developed by JFrog Ltd.
+(https://jfrog.com/).
+
+This product vendors skill content from jfrog/jfrog-skills
+(https://github.com/jfrog/jfrog-skills), pinned per
+.github/scripts/sync-skills-vendor.json. See that repository for its
+own license and copyright terms.
+
+--------------------------------------------------------------------
+Third-Party Software Notices
+--------------------------------------------------------------------
+
+This project has no third-party runtime dependencies. If dependencies
+are added in the future, list each here as:
+
+  <package-name> (<version>)
+  License: <SPDX-ID>
+  Homepage: <url>
+  Copyright: <copyright holder line from the upstream project>