chore: rename release artifacts and image binary to nudgebee-node-agent

.github/CODEOWNERS

@@ -0,0 +1,21 @@
+# Default reviewers for the whole repo.
+# Add or change owners as the team grows; nearest match wins.
+
+*       @nudgebee/engineering
+
+# eBPF probes need a closer eye — kernel quirks, license boundaries.
+/ebpftracer/                    @nudgebee/engineering
+/ebpftracer/ebpf/               @nudgebee/engineering
+
+# Release surface — CI, manifests, install script, Dockerfiles.
+/.github/workflows/             @nudgebee/engineering
+/manifests/                     @nudgebee/engineering
+/install.sh                     @nudgebee/engineering
+/Dockerfile                     @nudgebee/engineering
+/Dockerfile.alpine              @nudgebee/engineering
+
+# Legal / governance — changes here should be deliberate.
+/LICENSE                        @nudgebee/engineering
+/NOTICE                         @nudgebee/engineering
+/SECURITY.md                    @nudgebee/engineering
+/CODE_OF_CONDUCT.md             @nudgebee/engineering

.github/ISSUE_TEMPLATE/bug.yml

@@ -0,0 +1,58 @@
+name: Bug report
+description: The agent is doing the wrong thing or crashing
+labels: ["bug"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for taking the time to report a bug. The more concrete detail
+        you can give, the faster we can fix it.
+
+        Please do **not** include real credentials, tokens, or internal
+        hostnames in this issue. Replace them with `example.com` or `<redacted>`.
+  - type: textarea
+    id: what-happened
+    attributes:
+      label: What happened?
+      description: What did the agent do, and what did you expect instead?
+      placeholder: e.g. agent crashed with a panic after ~10 minutes on nodes with > 200 containers
+    validations:
+      required: true
+  - type: textarea
+    id: repro
+    attributes:
+      label: Steps to reproduce
+      description: Minimal repro. Workload type, kernel version, anything special about the environment.
+    validations:
+      required: true
+  - type: input
+    id: version
+    attributes:
+      label: Agent version
+      description: Output of `nudgebee-node-agent --version`, or the image tag.
+      placeholder: v1.2.3 / ghcr.io/nudgebee/node-agent:1.2.3
+    validations:
+      required: true
+  - type: input
+    id: kernel
+    attributes:
+      label: Linux kernel version
+      placeholder: e.g. 5.15.0-1042-aws
+    validations:
+      required: true
+  - type: input
+    id: distro
+    attributes:
+      label: Distribution / runtime
+      placeholder: e.g. Ubuntu 22.04 on EKS 1.30, containerd 1.7
+  - type: textarea
+    id: logs
+    attributes:
+      label: Relevant logs
+      description: Paste the relevant agent logs. Scrub any secrets first.
+      render: shell
+  - type: textarea
+    id: metrics
+    attributes:
+      label: Relevant metrics / Prometheus output (optional)
+      render: shell

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,8 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Security vulnerability
+    url: https://github.com/nudgebee/node-agent/security/advisories/new
+    about: Report security issues privately via GitHub Security Advisories or email security@nudgebee.com. Do not file a public issue.
+  - name: Discussion
+    url: https://github.com/nudgebee/node-agent/discussions
+    about: For questions, ideas, or anything that isn't yet a bug or a concrete feature request.

.github/ISSUE_TEMPLATE/feature.yml

@@ -0,0 +1,27 @@
+name: Feature request
+description: Suggest a new capability or enhancement
+labels: ["enhancement"]
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: What problem are you trying to solve?
+      description: Describe the use case, not the solution. We're looking for the underlying need.
+    validations:
+      required: true
+  - type: textarea
+    id: proposal
+    attributes:
+      label: What would you like to see?
+      description: A concrete proposal if you have one. Mock metric names, sample configs, CLI flags — anything that helps make it real.
+    validations:
+      required: true
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives you considered
+  - type: textarea
+    id: context
+    attributes:
+      label: Additional context
+      description: Links to related issues, upstream coroot/coroot-node-agent discussions, blog posts, etc.

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,36 @@
+<!--
+Thanks for the contribution. A short, focused description helps reviewers
+move fast. Delete sections that aren't applicable.
+-->
+
+## What this PR does
+
+<!-- One or two sentences. Focus on the "why" — the diff shows the "what". -->
+
+## Linked issue / context
+
+<!-- e.g. Fixes #123, or a short note if there's no issue. -->
+
+## How was this tested?
+
+<!--
+- Unit tests added/updated?
+- Did you run it on a real node / in a kind cluster?
+- Did /metrics still look sane after the change?
+-->
+
+## eBPF changes?
+
+<!--
+If yes:
+- [ ] I edited files under ebpftracer/ebpf/
+- [ ] I ran `cd ebpftracer && make build` to regenerate ebpftracer/ebpf.go
+- [ ] Both .c/.h sources and the regenerated ebpf.go are committed
+-->
+
+## Checklist
+
+- [ ] `make lint` passes (gofmt, goimports, go vet, go mod tidy)
+- [ ] `make test` passes
+- [ ] CHANGELOG.md updated under `## [Unreleased]` for user-visible changes
+- [ ] No real credentials, internal hostnames, or production captures in test fixtures

.github/dependabot.yml

@@ -0,0 +1,41 @@
+version: 2
+updates:
+  - package-ecosystem: gomod
+    directory: "/"
+    schedule:
+      interval: weekly
+      day: monday
+    open-pull-requests-limit: 10
+    groups:
+      otel:
+        patterns:
+          - "go.opentelemetry.io/*"
+          - "github.com/agoda-com/opentelemetry-logs-go*"
+      k8s:
+        patterns:
+          - "k8s.io/*"
+          - "sigs.k8s.io/*"
+      prometheus:
+        patterns:
+          - "github.com/prometheus/*"
+    labels:
+      - dependencies
+      - go
+
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: weekly
+      day: monday
+    labels:
+      - dependencies
+      - github-actions
+
+  - package-ecosystem: docker
+    directory: "/"
+    schedule:
+      interval: weekly
+      day: monday
+    labels:
+      - dependencies
+      - docker

.github/workflows/ci.yml

@@ -6,8 +6,12 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+
 jobs:
-  GO:
+  go:
+    name: Go (build, vet, test)
     runs-on: ubuntu-22.04
     steps:
       - uses: actions/checkout@v4
@@ -25,5 +29,47 @@ jobs:
           go install golang.org/x/tools/cmd/goimports@latest
           files=$(goimports -l .); if [[ -n "$files" ]]; then echo "$files"; exit 1; fi
       - run: go vet ./...
+      # /containers transitively imports github.com/NVIDIA/go-nvml. The
+      # bindings register NVML symbols (including some only present in
+      # very recent libnvidia-ml.so versions, e.g.
+      # nvmlDeviceSetMemClkVfOffset) at process start via dlsym, which
+      # fails on a runner without a matching NVIDIA driver and aborts
+      # the test binary before any of our tests run. Skip until either
+      # GPU code moves behind a build tag or the runner ships a newer
+      # libnvidia-ml.so.
       - run: go test $(go list ./... | grep -v '/containers$')
       - run: go build -mod=readonly .
+
+  secrets:
+    name: Secret scan
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      # Run the gitleaks CLI directly (BSD-licensed, free for orgs).
+      # gitleaks/gitleaks-action requires a paid licence when run on an
+      # org-owned repository, which we don't need for this use case.
+      - name: Install gitleaks
+        run: |
+          curl -sSL https://github.com/gitleaks/gitleaks/releases/download/v8.21.2/gitleaks_8.21.2_linux_x64.tar.gz \
+            | sudo tar -xz -C /usr/local/bin gitleaks
+          gitleaks version
+      # Scan only the commits introduced by this event:
+      #   - PR: base..HEAD
+      #   - push: before..after
+      # Pre-existing secrets in history are tracked separately and will
+      # be purged by a one-time git-filter-repo pass before the repo
+      # goes public.
+      - name: Scan PR commits
+        if: github.event_name == 'pull_request'
+        run: |
+          gitleaks detect --no-banner --config .gitleaks.toml \
+            --redact --verbose --exit-code 1 \
+            --log-opts="${{ github.event.pull_request.base.sha }}..HEAD"
+      - name: Scan pushed commits
+        if: github.event_name == 'push'
+        run: |
+          gitleaks detect --no-banner --config .gitleaks.toml \
+            --redact --verbose --exit-code 1 \
+            --log-opts="${{ github.event.before }}..${{ github.event.after }}"

.github/workflows/release.yml

@@ -61,12 +61,12 @@ jobs:
       - name: extract amd64 binary from the image
         run: |
           docker create --platform linux/amd64 --name amd64 ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.meta.outputs.version }}
-          docker cp amd64:/usr/bin/coroot-node-agent /tmp/coroot-node-agent-amd64
+          docker cp amd64:/usr/bin/nudgebee-node-agent /tmp/nudgebee-node-agent-${{ steps.meta.outputs.version }}-amd64
 
       - name: extract arm64 binary from the image
         run: |
           docker create --platform linux/arm64 --name arm64 ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.meta.outputs.version }}
-          docker cp arm64:/usr/bin/coroot-node-agent /tmp/coroot-node-agent-arm64
+          docker cp arm64:/usr/bin/nudgebee-node-agent /tmp/nudgebee-node-agent-${{ steps.meta.outputs.version }}-arm64
 
       - name: Create GitHub release with binaries
         uses: softprops/action-gh-release@v2
@@ -75,5 +75,5 @@ jobs:
           name: ${{ github.ref_name }}
           make_latest: true
           files: |
-            /tmp/coroot-node-agent-amd64
-            /tmp/coroot-node-agent-arm64
+            /tmp/nudgebee-node-agent-${{ steps.meta.outputs.version }}-amd64
+            /tmp/nudgebee-node-agent-${{ steps.meta.outputs.version }}-arm64

.gitignore

@@ -1,2 +1,41 @@
-.idea
-.vagrant
+# Editors / IDEs
+.idea/
+.vscode/
+*.swp
+*.swo
+*~
+
+# OS
+.DS_Store
+Thumbs.db
+
+# Vagrant
+.vagrant/
+
+# Go build artifacts
+/nudgebee-node-agent
+/coroot-node-agent
+*.exe
+*.test
+*.out
+
+# Go coverage / profiling
+*.prof
+*.pprof
+coverage.txt
+coverage.html
+
+# Build / dist
+/dist/
+/build/
+/bin/
+
+# Vendored modules (we don't vendor)
+/vendor/
+
+# Local env files
+.env
+.env.local
+
+# eBPF build outputs (regenerated via ebpftracer/make build)
+ebpftracer/ebpf/*.o

.gitleaks.toml

@@ -0,0 +1,21 @@
+# gitleaks config — extends the default ruleset.
+# Run locally with: gitleaks detect --config .gitleaks.toml
+[extend]
+useDefault = true
+
+[allowlist]
+description = "Synthetic placeholders used in test fixtures"
+regexes = [
+  # AWS's documented example access key, used in ebpftracer/l7/l7_test.go
+  '''AKIAIOSFODNN7EXAMPLE''',
+  # Synthetic redaction markers, not real credentials
+  '''EXAMPLE_SESSION_TOKEN_REDACTED''',
+  '''EXAMPLE_COOKIE_REDACTED''',
+  '''EXAMPLE_REMOTE_WRITE_BODY_REDACTED''',
+  '''EXAMPLE\.JWT\.TOKEN_REDACTED''',
+]
+paths = [
+  # GPL-2.0 text contains nothing secret but does include the FSF
+  # postal address regexp may flag certain text patterns
+  '''LICENSES/GPL-2\.0\.txt''',
+]

CHANGELOG.md

@@ -0,0 +1,31 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+### Added
+
+- Open-source release of the Nudgebee Node Agent, forked from
+  [coroot/coroot-node-agent](https://github.com/coroot/coroot-node-agent).
+- LLM observability pipeline: detects and parses LLM API traffic
+  (OpenAI, Bedrock, Google AI, Anthropic, others) and emits per-request
+  metrics with token counts, latency, and pricing.
+- IP-to-FQDN resolver: enriches outbound flows with reverse-DNS names
+  via HTTP `Host` headers and DNS metadata.
+- Enhanced eBPF L7 protocol detection: TLS SNI, HTTP/2, Node.js, and
+  improved Go TLS capture.
+- Oracle Cloud instance-metadata support.
+- Pressure Stall Information (PSI) cgroup metrics.
+
+### Changed
+
+- Prometheus `job` label and outbound `User-Agent` are now
+  `nudgebee-node-agent`. Update any dashboards or alerts that filter on
+  `job="coroot-node-agent"`.
+- OpenTelemetry service name is now `nudgebee-node-agent`.
+- Default systemd unit name is `nudgebee-node-agent.service`.
+- Container image is published at `ghcr.io/nudgebee/node-agent`.