Prepare repository for Datadog open source review

.github/CODEOWNERS

@@ -0,0 +1,2 @@
+# Agent Data Plane has default ownership over everything.
+* @DataDog/agent-data-plane

.github/ISSUE_TEMPLATE/bug-report.yaml

@@ -0,0 +1,49 @@
+# Unless explicitly stated otherwise all files in this repository are licensed under the MIT License.
+#
+# This product includes software developed at Datadog (https://www.datadoghq.com/)
+# Copyright 2026 Datadog, Inc.
+
+name: Bug report
+description: Report a reproducible problem in rustls-cng-crypto
+title: "[BUG] "
+labels: [bug]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for reporting a problem. Please do not include secrets, private keys, or sensitive certificate material.
+  - type: textarea
+    id: description
+    attributes:
+      label: What happened?
+      description: Describe the problem and the behavior you expected.
+    validations:
+      required: true
+  - type: textarea
+    id: reproduce
+    attributes:
+      label: Reproduction steps
+      description: Provide the smallest example or command sequence that reproduces the issue.
+    validations:
+      required: true
+  - type: input
+    id: version
+    attributes:
+      label: rustls-cng-crypto version
+      placeholder: "0.1.2"
+    validations:
+      required: true
+  - type: input
+    id: windows
+    attributes:
+      label: Windows version
+      placeholder: "Windows Server 2022, Windows 11 24H2, etc."
+    validations:
+      required: true
+  - type: textarea
+    id: additional
+    attributes:
+      label: Additional context
+      description: Add logs, error messages, or links to a minimal reproduction if available.
+    validations:
+      required: false

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,10 @@
+# Unless explicitly stated otherwise all files in this repository are licensed under the MIT License.
+#
+# This product includes software developed at Datadog (https://www.datadoghq.com/)
+# Copyright 2026 Datadog, Inc.
+
+blank_issues_enabled: true
+contact_links:
+  - name: Security vulnerability report
+    url: https://www.datadoghq.com/security/
+    about: Please report security vulnerabilities privately through Datadog's security channel.

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,27 @@
+<!--
+Unless explicitly stated otherwise all files in this repository are licensed under the MIT License.
+
+This product includes software developed at Datadog (https://www.datadoghq.com/)
+Copyright 2026 Datadog, Inc.
+-->
+
+## Summary
+
+Describe the change and why it is needed.
+
+## Testing
+
+List the commands you ran and their results.
+
+- [ ] `cargo fmt -- --check`
+- [ ] `make check-licenses`
+- [ ] `cargo test` or GitHub Actions Windows CI
+
+## License inventory
+
+- [ ] Dependency changes are reflected in `Cargo.lock` and `LICENSE-3rdparty.csv`, or this PR does not change dependencies.
+
+## Checklist
+
+- [ ] Documentation is updated for user-visible changes.
+- [ ] Security-sensitive behavior is described clearly for reviewers.

.github/chainguard/self.renovate-sync-licenses.sts.yaml

@@ -0,0 +1,17 @@
+# Unless explicitly stated otherwise all files in this repository are licensed under the MIT License.
+#
+# This product includes software developed at Datadog (https://www.datadoghq.com/)
+# Copyright 2026 Datadog, Inc.
+
+# Docs: https://datadoghq.atlassian.net/wiki/spaces/SECENG/pages/5138645099/User+guide+dd-octo-sts
+issuer: https://token.actions.githubusercontent.com
+
+subject: repo:DataDog/rustls-cng-crypto:pull_request
+
+claim_pattern:
+  event_name: pull_request
+  head_ref: renovate/.*
+  job_workflow_ref: DataDog/rustls-cng-crypto/\.github/workflows/renovate-sync-licenses\.yml@refs/pull/[0-9]+/merge
+
+permissions:
+  contents: write

.github/dependabot.yml

@@ -1,3 +1,8 @@
+# Unless explicitly stated otherwise all files in this repository are licensed under the MIT License.
+#
+# This product includes software developed at Datadog (https://www.datadoghq.com/)
+# Copyright 2026 Datadog, Inc.
+
 version: 2
 updates:
   - package-ecosystem: "cargo"

.github/workflows/ci.yml

@@ -1,73 +1,93 @@
+# Unless explicitly stated otherwise all files in this repository are licensed under the MIT License.
+#
+# This product includes software developed at Datadog (https://www.datadoghq.com/)
+# Copyright 2026 Datadog, Inc.
 
 name: CI
 on:
   push:
     branches: [main]
   pull_request:
+  workflow_dispatch:
 permissions:
   contents: read
 
 env:
   CARGO_TERM_COLOR: always
 
 jobs:
+  license:
+    name: License Inventory
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - name: Install toolchain
+        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1
+        with:
+          toolchain: stable
+      - name: Cache build artifacts
+        uses: Swatinem/rust-cache@42dc69e1aa15d09112580998cf2ef0119e2e91ae # v2
+      - name: Check third-party license inventory
+        run: make check-licenses
+
   test:
     name: Test
-    runs-on: windows-latest
+    runs-on: windows-2022
     steps:
       - name: Check out repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
       - name: Install toolchain
-        uses: dtolnay/rust-toolchain@v1
+        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1
         with:
           toolchain: stable
       - name: Cache build artifacts
-        uses: Swatinem/rust-cache@v2
+        uses: Swatinem/rust-cache@42dc69e1aa15d09112580998cf2ef0119e2e91ae # v2
       - name: cargo test
         run: cargo test
       # https://github.com/rust-lang/cargo/issues/6669
       - name: cargo test --doc
         run: cargo test --doc
+
   lint:
     name: Lint
-    runs-on: windows-latest
+    runs-on: windows-2022
     steps:
       - name: Check out repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
       - name: Install toolchain
-        uses: dtolnay/rust-toolchain@v1
+        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1
         with:
           toolchain: stable
           components: rustfmt, clippy
       - name: Cache build artifacts
-        uses: Swatinem/rust-cache@v2
+        uses: Swatinem/rust-cache@42dc69e1aa15d09112580998cf2ef0119e2e91ae # v2
       - name: cargo fmt (check)
         run: cargo fmt -- --check -l
       - name: cargo clippy (warnings)
         run: cargo clippy --all-targets -- -D warnings
       - name: cargo clippy --no-default-features (warnings)
         run: cargo clippy --no-default-features --all-targets -- -D warnings
 
-
   coverage:
     name: Coverage
-    runs-on: windows-latest
+    runs-on: windows-2022
     steps:
       - name: Check out repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
       - name: Install toolchain
-        uses: dtolnay/rust-toolchain@v1
+        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1
         with:
           toolchain: stable
           components: llvm-tools
       - name: Cache build artifacts
-        uses: Swatinem/rust-cache@v2
+        uses: Swatinem/rust-cache@42dc69e1aa15d09112580998cf2ef0119e2e91ae # v2
       - name: Install cargo-llvm-cov
-        uses: taiki-e/install-action@cargo-llvm-cov
+        uses: taiki-e/install-action@50570a4fd0cb7e583e6a512c02bffb9ade28d868 # cargo-llvm-cov
       - name: Generate coverage
         run: cargo llvm-cov --lcov --output-path lcov.info
       - name: Report to codecov.io
-        uses: codecov/codecov-action@v5
+        uses: codecov/codecov-action@04b047e8bb82a0c002c8312c1c880fbc6a999d45 # v5
         with:
           files: lcov.info
           token: ${{ secrets.CODECOV_TOKEN }}

.github/workflows/renovate-sync-licenses.yml

@@ -0,0 +1,93 @@
+# Unless explicitly stated otherwise all files in this repository are licensed under the MIT License.
+#
+# This product includes software developed at Datadog (https://www.datadoghq.com/)
+# Copyright 2026 Datadog, Inc.
+
+# rustls-cng-crypto maintains a LICENSE-3rdparty.csv file listing every third-party dependency and its license.
+# The license CI check verifies that this file is in sync with Cargo.lock. Renovate updates Cargo.lock
+# when it bumps dependency versions, but it has no way to regenerate the license file because that
+# requires running dd-rust-license-tool.
+#
+# This workflow detects Renovate PRs, regenerates LICENSE-3rdparty.csv, and pushes a signed commit
+# back to the PR branch so license checks pass without human intervention. Human reviewers still see
+# and review the license file changes.
+
+name: "Renovate: Sync Third-Party Licenses"
+
+on:
+  pull_request:
+    types: [opened, synchronize]
+
+jobs:
+  sync-licenses:
+    runs-on: ubuntu-latest
+
+    if: >
+      github.actor == 'renovate[bot]' &&
+      startsWith(github.head_ref, 'renovate/')
+
+    timeout-minutes: 15
+
+    permissions:
+      id-token: write
+
+    steps:
+      - name: Get access token from dd-octo-sts
+        uses: DataDog/dd-octo-sts-action@96a25462dbcb10ebf0bfd6e2ccc917d2ab235b9a # v1.0.4
+        id: octo-sts
+        with:
+          scope: DataDog/rustls-cng-crypto
+          policy: self.renovate-sync-licenses
+
+      - name: Checkout PR branch
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          ref: ${{ github.head_ref }}
+          token: "${{ steps.octo-sts.outputs.token }}"
+
+      - name: Set up Rust toolchain
+        uses: actions-rust-lang/setup-rust-toolchain@46268bd060767258de96ed93c1251119784f2ab6 # v1.16
+        with:
+          cache: false
+          rustflags: ""
+
+      - name: Install dd-rust-license-tool
+        run: |
+          TOOL_VERSION=$(grep 'CARGO_TOOL_VERSION_dd-rust-license-tool' Makefile | head -1 | sed 's/.*?= //')
+          cargo install "dd-rust-license-tool@${TOOL_VERSION}"
+
+      - name: Sync third-party license file
+        run: $HOME/.cargo/bin/dd-rust-license-tool write
+
+      - name: Check for changes
+        id: changes
+        run: |
+          if git diff --quiet LICENSE-3rdparty.csv; then
+            echo "changed=false" >> $GITHUB_OUTPUT
+          else
+            echo "changed=true" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Configure Git
+        if: steps.changes.outputs.changed == 'true'
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+
+      - name: Commit changes
+        id: commit
+        if: steps.changes.outputs.changed == 'true'
+        run: |
+          git add LICENSE-3rdparty.csv
+          git commit -m "chore(deps): sync third-party license file"
+          echo "commit_sha=$(git rev-parse HEAD)" >> $GITHUB_OUTPUT
+
+      - name: Sign and push commit
+        if: steps.changes.outputs.changed == 'true'
+        uses: DataDog/commit-headless@5a0f3876e0fbdd3a86b3e008acf4ec562db59eee # v2.0.1
+        with:
+          token: "${{ steps.octo-sts.outputs.token }}"
+          branch: ${{ github.head_ref }}
+          head-sha: ${{ github.event.pull_request.head.sha }}
+          command: push
+          commits: "${{ steps.commit.outputs.commit_sha }}"

.gitignore

@@ -1,3 +1,7 @@
+# Unless explicitly stated otherwise all files in this repository are licensed under the MIT License.
+#
+# This product includes software developed at Datadog (https://www.datadoghq.com/)
+# Copyright 2026 Datadog, Inc.
+
 target/
-Cargo.lock
 lcov.info

CONTRIBUTING.md

@@ -0,0 +1,49 @@
+<!--
+Unless explicitly stated otherwise all files in this repository are licensed under the MIT License.
+
+This product includes software developed at Datadog (https://www.datadoghq.com/)
+Copyright 2026 Datadog, Inc.
+-->
+
+# Contributing to rustls-cng-crypto
+
+Thanks for your interest in contributing to `rustls-cng-crypto`.
+
+## Development setup
+
+This crate implements a rustls crypto provider backed by Windows CNG. Full test coverage requires a Windows host because the implementation calls Windows cryptography APIs.
+
+Install a stable Rust toolchain, then run:
+
+```bash
+cargo fmt -- --check
+cargo test
+```
+
+On non-Windows hosts, use formatting and metadata checks locally, then rely on GitHub Actions for Windows validation.
+
+## License inventory
+
+This repository tracks third-party Rust dependencies in `LICENSE-3rdparty.csv`. The file is generated from `Cargo.lock` with Datadog's Rust license inventory tool.
+
+After changing dependencies, run:
+
+```bash
+make sync-licenses
+make check-licenses
+```
+
+Commit `Cargo.lock`, `LICENSE-3rdparty.csv`, and any required `license-tool.toml` override changes together. Do not hand-edit generated `LICENSE-3rdparty.csv` rows.
+
+## Pull requests
+
+Before opening a pull request:
+
+1. Run `cargo fmt -- --check`.
+2. Run `make check-licenses`.
+3. Run `cargo test` on Windows or confirm that GitHub Actions will provide Windows test coverage.
+4. Update documentation for user-visible changes.
+
+## License
+
+Unless explicitly stated otherwise, contributions are licensed under the MIT License. See `LICENSE` for the repository license and `LICENSE-3rdparty.csv` for third-party dependency notices.