Add NOTICE and CLA workflow for OSS governance compliance

.github/scripts/sync-skills.mjs

@@ -1,4 +1,9 @@
 #!/usr/bin/env node
+
+// Copyright (c) JFrog Ltd. 2026
+// Licensed under the Apache License, Version 2.0
+// https://www.apache.org/licenses/LICENSE-2.0
+
 // Vendors skill content from the upstream jfrog/jfrog-skills repository
 // into this plugin. Run manually when bumping the pin: bump `pin` in
 // sync-skills-vendor.json, then run this

.github/workflows/cla.yml

@@ -0,0 +1,29 @@
+# Copyright (c) JFrog Ltd. 2026
+# Licensed under the Apache License, Version 2.0
+# https://www.apache.org/licenses/LICENSE-2.0
+
+name: "CLA Assistant"
+on:
+  # issue_comment triggers this action on each comment on issues and pull requests
+  issue_comment:
+    types: [ created ]
+  pull_request_target:
+    types: [ opened, synchronize ]
+permissions:
+  actions: write
+  contents: write
+  pull-requests: write
+  issues: write
+  statuses: write
+
+jobs:
+  CLAssistant:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Run CLA Check
+        uses: jfrog/.github/actions/cla@main
+        with:
+          event_comment_body: ${{ github.event.comment.body }}
+          event_name: ${{ github.event_name }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          CLA_SIGN_TOKEN: ${{ secrets.CLA_SIGN_TOKEN }}

NOTICE

@@ -0,0 +1,23 @@
+NOTICE
+JFrog devin-plugin
+Copyright (c) 2026 JFrog Ltd.
+
+This product includes software developed by JFrog Ltd.
+(https://jfrog.com/).
+
+This product vendors skill content from jfrog/jfrog-skills
+(https://github.com/jfrog/jfrog-skills), pinned per
+.github/scripts/sync-skills-vendor.json. See that repository for its
+own license and copyright terms.
+
+--------------------------------------------------------------------
+Third-Party Software Notices
+--------------------------------------------------------------------
+
+This project has no third-party runtime dependencies. If dependencies
+are added in the future, list each here as:
+
+  <package-name> (<version>)
+  License: <SPDX-ID>
+  Homepage: <url>
+  Copyright: <copyright holder line from the upstream project>