From 937525297c45a135f99d29a2dbbbf2c1880f0089 Mon Sep 17 00:00:00 2001
From: Zbynek Roubalik <zroubalik@gmail.com>
Date: Mon, 7 Sep 2026 18:39:12 +0200
Subject: [PATCH 01/10] feat: package local insights analyzer

Signed-off-by: Zbynek Roubalik <zroubalik@gmail.com>
---
 .github/workflows/pr-check.yaml  |  19 ++++
 .github/workflows/release.yaml   |  34 ++++++++
 .gitignore                       |   1 +
 .goreleaser.yaml                 |  48 +++++++++++
 README.md                        |  64 ++++++++++++--
 cmd/kedify-analyzer/main.go      |  77 +++++++++++++++++
 cmd/kedify-analyzer/main_test.go | 144 +++++++++++++++++++++++++++++++
 7 files changed, 382 insertions(+), 5 deletions(-)
 create mode 100644 .github/workflows/release.yaml
 create mode 100644 .gitignore
 create mode 100644 .goreleaser.yaml
 create mode 100644 cmd/kedify-analyzer/main.go
 create mode 100644 cmd/kedify-analyzer/main_test.go

diff --git a/.github/workflows/pr-check.yaml b/.github/workflows/pr-check.yaml
index b29b8ab..6987c62 100644
--- a/.github/workflows/pr-check.yaml
+++ b/.github/workflows/pr-check.yaml
@@ -13,3 +13,22 @@ jobs:
     with:
       continue_on_error: false
       skip_private_key_setup: true
+
+  package:
+    name: Build release artifacts
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+
+      - name: Set up Go
+        uses: actions/setup-go@v6
+        with:
+          go-version-file: go.mod
+
+      - name: Build snapshot archives
+        uses: goreleaser/goreleaser-action@v7
+        with:
+          distribution: goreleaser
+          version: "~> v2"
+          args: release --snapshot --clean
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
new file mode 100644
index 0000000..765fc19
--- /dev/null
+++ b/.github/workflows/release.yaml
@@ -0,0 +1,34 @@
+name: Release analyzer
+
+on:
+  push:
+    tags:
+      - "v*"
+
+permissions:
+  contents: read
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+
+      - name: Set up Go
+        uses: actions/setup-go@v6
+        with:
+          go-version-file: go.mod
+
+      - name: Release
+        uses: goreleaser/goreleaser-action@v7
+        with:
+          distribution: goreleaser
+          version: "~> v2"
+          args: release --clean
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..178135c
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1 @@
+/dist/
diff --git a/.goreleaser.yaml b/.goreleaser.yaml
new file mode 100644
index 0000000..bceef9c
--- /dev/null
+++ b/.goreleaser.yaml
@@ -0,0 +1,48 @@
+version: 2
+
+project_name: kedify-analyzer
+
+builds:
+  - id: kedify-analyzer
+    main: ./cmd/kedify-analyzer
+    binary: kedify-analyzer
+    env:
+      - CGO_ENABLED=0
+    goos:
+      - linux
+      - darwin
+      - windows
+    goarch:
+      - amd64
+      - arm64
+    ignore:
+      - goos: windows
+        goarch: arm64
+    ldflags:
+      - -s -w -X main.version={{ .Version }}
+    mod_timestamp: "{{ .CommitTimestamp }}"
+
+archives:
+  - ids:
+      - kedify-analyzer
+    name_template: >-
+      {{ .ProjectName }}_{{ .Version }}_{{ .Os }}_{{ .Arch }}
+    formats:
+      - tar.gz
+    format_overrides:
+      - goos: windows
+        formats:
+          - zip
+
+checksum:
+  name_template: "{{ .ProjectName }}_{{ .Version }}_checksums.txt"
+
+release:
+  make_latest: true
+  prerelease: auto
+
+changelog:
+  use: git
+
+snapshot:
+  version_template: "{{ .Version }}-next"
diff --git a/README.md b/README.md
index 80f3535..666ca0a 100644
--- a/README.md
+++ b/README.md
@@ -23,8 +23,62 @@ adapter; the normalized `aggregatedUsage` value must match the supplied policy.
 
 - `dashboard-api-service` imports this module and adapts stored Kedify telemetry or
   Prometheus-compatible results to the normalized input.
-- Private offline components may import the same module.
-- The public [`kedify/cli`](https://github.com/kedify/cli) remains an API/results
-  client and does not embed this private engine.
-- Offline packaging is tracked by
-  [`kedify/agent#618`](https://github.com/kedify/agent/issues/618).
+- `kedify-analyzer` packages the engine as a separate, network-free executable.
+- The public [`kedify/cli`](https://github.com/kedify/cli) does not import this
+  private module. Local analysis integration is tracked by
+  [`kedify/agent#618`](https://github.com/kedify/agent/issues/618) and
+  [`kedify/cli#14`](https://github.com/kedify/cli/issues/14).
+
+## Local analyzer
+
+Build and invoke the executable with a single JSON request on standard input:
+
+```sh
+go build -o kedify-analyzer ./cmd/kedify-analyzer
+kedify-analyzer < request.json > response.json
+```
+
+Diagnostics are written to standard error; standard output contains only the JSON
+response. The current request contract is:
+
+```json
+{
+  "protocolVersion": "kedify-analyzer/v1",
+  "input": {
+    "schemaVersion": "resource-analysis-input/v1",
+    "observedIntervalHours": 24,
+    "containers": []
+  },
+  "policy": {}
+}
+```
+
+The response contains `protocolVersion`, `analyzerVersion`, `engineVersion`,
+`inputSchemaVersion`, `outputSchemaVersion`, and the engine `output`. Only the exact
+`kedify-analyzer/v1` protocol is accepted. The engine validates its input schema and
+policy; there is no compatibility conversion in the executable.
+
+Exit codes are stable for this protocol:
+
+| Code | Meaning |
+| ---: | --- |
+| `0` | Analysis completed and a response was written. |
+| `1` | The analyzer could not write its response. |
+| `2` | The request, protocol, schema, policy, or normalized input is invalid. |
+
+Release archives include the following executables:
+
+- Linux: `amd64`, `arm64`
+- macOS: `amd64`, `arm64`
+- Windows: `amd64`
+
+Consumers should prefer an explicitly configured analyzer path, then a binary next
+to the consuming executable, and finally `kedify-analyzer` (`kedify-analyzer.exe`
+on Windows) on `PATH`. They must validate the returned protocol, engine, and schema
+versions they support. Public CLI discovery and invocation are implemented separately
+in [`kedify/cli#14`](https://github.com/kedify/cli/issues/14).
+
+For an air-gapped environment, download the matching platform archive and its
+`kedify-analyzer_<version>_checksums.txt` file in advance, verify the SHA-256 checksum,
+and copy the extracted executable to the configured location. The analyzer performs
+no network access and never downloads or updates itself.
diff --git a/cmd/kedify-analyzer/main.go b/cmd/kedify-analyzer/main.go
new file mode 100644
index 0000000..a4af5c7
--- /dev/null
+++ b/cmd/kedify-analyzer/main.go
@@ -0,0 +1,77 @@
+package main
+
+import (
+	"encoding/json"
+	"fmt"
+	"io"
+	"os"
+
+	"github.com/kedify/recommender/analysis"
+)
+
+const (
+	protocolVersion = "kedify-analyzer/v1"
+	exitSuccess     = 0
+	exitInternal    = 1
+	exitInvalid     = 2
+)
+
+var version = "dev"
+
+type request struct {
+	ProtocolVersion string          `json:"protocolVersion"`
+	Input           analysis.Input  `json:"input"`
+	Policy          analysis.Policy `json:"policy"`
+}
+
+type response struct {
+	ProtocolVersion     string          `json:"protocolVersion"`
+	AnalyzerVersion     string          `json:"analyzerVersion"`
+	EngineVersion       string          `json:"engineVersion"`
+	InputSchemaVersion  string          `json:"inputSchemaVersion"`
+	OutputSchemaVersion string          `json:"outputSchemaVersion"`
+	Output              analysis.Output `json:"output"`
+}
+
+func main() {
+	os.Exit(run(os.Stdin, os.Stdout, os.Stderr))
+}
+
+func run(stdin io.Reader, stdout, stderr io.Writer) int {
+	decoder := json.NewDecoder(stdin)
+	decoder.DisallowUnknownFields()
+
+	var req request
+	if err := decoder.Decode(&req); err != nil {
+		fmt.Fprintf(stderr, "kedify-analyzer: invalid request: %v\n", err)
+		return exitInvalid
+	}
+	if err := decoder.Decode(&struct{}{}); err != io.EOF {
+		fmt.Fprintln(stderr, "kedify-analyzer: invalid request: expected one JSON object")
+		return exitInvalid
+	}
+	if req.ProtocolVersion != protocolVersion {
+		fmt.Fprintf(stderr, "kedify-analyzer: unsupported protocolVersion %q; expected %q\n", req.ProtocolVersion, protocolVersion)
+		return exitInvalid
+	}
+
+	output, err := analysis.Analyze(req.Input, req.Policy)
+	if err != nil {
+		fmt.Fprintf(stderr, "kedify-analyzer: analysis failed: %v\n", err)
+		return exitInvalid
+	}
+
+	result := response{
+		ProtocolVersion:     protocolVersion,
+		AnalyzerVersion:     version,
+		EngineVersion:       analysis.ResourceRightSizeDetectorVersion,
+		InputSchemaVersion:  analysis.InputSchemaVersion,
+		OutputSchemaVersion: analysis.OutputSchemaVersion,
+		Output:              output,
+	}
+	if err := json.NewEncoder(stdout).Encode(result); err != nil {
+		fmt.Fprintf(stderr, "kedify-analyzer: unable to write response: %v\n", err)
+		return exitInternal
+	}
+	return exitSuccess
+}
diff --git a/cmd/kedify-analyzer/main_test.go b/cmd/kedify-analyzer/main_test.go
new file mode 100644
index 0000000..44e089a
--- /dev/null
+++ b/cmd/kedify-analyzer/main_test.go
@@ -0,0 +1,144 @@
+package main
+
+import (
+	"bytes"
+	"encoding/json"
+	"errors"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"reflect"
+	"runtime"
+	"strings"
+	"testing"
+
+	"github.com/kedify/recommender/analysis"
+)
+
+func TestAnalyzerExecutable(t *testing.T) {
+	binary := filepath.Join(t.TempDir(), "kedify-analyzer")
+	if runtime.GOOS == "windows" {
+		binary += ".exe"
+	}
+	build := exec.Command("go", "build", "-o", binary, ".")
+	if output, err := build.CombinedOutput(); err != nil {
+		t.Fatalf("build analyzer: %v\n%s", err, output)
+	}
+
+	requestBytes := validRequest(t)
+	first := executeAnalyzer(t, binary, requestBytes, exitSuccess)
+	second := executeAnalyzer(t, binary, requestBytes, exitSuccess)
+	if !bytes.Equal(first.stdout, second.stdout) {
+		t.Fatalf("same request produced different output\nfirst: %s\nsecond: %s", first.stdout, second.stdout)
+	}
+	if len(first.stderr) != 0 {
+		t.Fatalf("successful analysis wrote diagnostics: %s", first.stderr)
+	}
+
+	var got response
+	if err := json.Unmarshal(first.stdout, &got); err != nil {
+		t.Fatalf("decode response: %v", err)
+	}
+	if got.ProtocolVersion != protocolVersion || got.AnalyzerVersion != "dev" ||
+		got.EngineVersion != analysis.ResourceRightSizeDetectorVersion ||
+		got.InputSchemaVersion != analysis.InputSchemaVersion || got.OutputSchemaVersion != analysis.OutputSchemaVersion {
+		t.Fatalf("unexpected response metadata: %#v", got)
+	}
+
+	expectedBytes, err := os.ReadFile("../../analysis/testdata/default-output.json")
+	if err != nil {
+		t.Fatal(err)
+	}
+	var expected analysis.Output
+	if err := json.Unmarshal(expectedBytes, &expected); err != nil {
+		t.Fatal(err)
+	}
+	if !reflect.DeepEqual(got.Output, expected) {
+		t.Fatalf("analyzer output differs from engine fixture\ngot: %#v\nwant: %#v", got.Output, expected)
+	}
+
+	tests := []struct {
+		name   string
+		input  string
+		stderr string
+	}{
+		{name: "missing protocol", input: `{}`, stderr: `unsupported protocolVersion ""`},
+		{name: "incompatible protocol", input: `{"protocolVersion":"kedify-analyzer/v2"}`, stderr: `unsupported protocolVersion "kedify-analyzer/v2"`},
+		{name: "missing schema", input: `{"protocolVersion":"kedify-analyzer/v1"}`, stderr: `unsupported input schema version ""`},
+		{name: "incompatible schema", input: `{"protocolVersion":"kedify-analyzer/v1","input":{"schemaVersion":"resource-analysis-input/v2"}}`, stderr: `unsupported input schema version "resource-analysis-input/v2"`},
+		{name: "invalid analysis input", input: `{"protocolVersion":"kedify-analyzer/v1","input":{"schemaVersion":"resource-analysis-input/v1"}}`, stderr: `observedIntervalHours must be greater than 0`},
+		{name: "unknown field", input: `{"protocolVersion":"kedify-analyzer/v1","unexpected":true}`, stderr: `unknown field "unexpected"`},
+		{name: "malformed JSON", input: `{"protocolVersion":`, stderr: `invalid request`},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			result := executeAnalyzer(t, binary, []byte(test.input), exitInvalid)
+			if len(result.stdout) != 0 {
+				t.Fatalf("invalid request wrote machine output: %s", result.stdout)
+			}
+			if !strings.Contains(string(result.stderr), test.stderr) {
+				t.Fatalf("stderr = %q, want substring %q", result.stderr, test.stderr)
+			}
+		})
+	}
+}
+
+func TestRunReturnsInternalErrorWhenResponseCannotBeWritten(t *testing.T) {
+	var stderr bytes.Buffer
+	if code := run(bytes.NewReader(validRequest(t)), errorWriter{}, &stderr); code != exitInternal {
+		t.Fatalf("run() = %d, want %d", code, exitInternal)
+	}
+	if !strings.Contains(stderr.String(), "unable to write response") {
+		t.Fatalf("unexpected stderr: %s", stderr.String())
+	}
+}
+
+func validRequest(t *testing.T) []byte {
+	t.Helper()
+	inputBytes, err := os.ReadFile("../../analysis/testdata/default-input.json")
+	if err != nil {
+		t.Fatal(err)
+	}
+	var input analysis.Input
+	if err := json.Unmarshal(inputBytes, &input); err != nil {
+		t.Fatal(err)
+	}
+	requestBytes, err := json.Marshal(request{ProtocolVersion: protocolVersion, Input: input})
+	if err != nil {
+		t.Fatal(err)
+	}
+	return requestBytes
+}
+
+type execution struct {
+	stdout []byte
+	stderr []byte
+}
+
+func executeAnalyzer(t *testing.T, binary string, input []byte, wantExit int) execution {
+	t.Helper()
+	cmd := exec.Command(binary)
+	cmd.Stdin = bytes.NewReader(input)
+	var stdout, stderr bytes.Buffer
+	cmd.Stdout = &stdout
+	cmd.Stderr = &stderr
+	err := cmd.Run()
+	gotExit := exitSuccess
+	if err != nil {
+		var exitError *exec.ExitError
+		if !errors.As(err, &exitError) {
+			t.Fatalf("execute analyzer: %v", err)
+		}
+		gotExit = exitError.ExitCode()
+	}
+	if gotExit != wantExit {
+		t.Fatalf("exit code = %d, want %d; stderr: %s", gotExit, wantExit, stderr.String())
+	}
+	return execution{stdout: stdout.Bytes(), stderr: stderr.Bytes()}
+}
+
+type errorWriter struct{}
+
+func (errorWriter) Write([]byte) (int, error) {
+	return 0, errors.New("write failed")
+}

From fd26f67ea3d3f9cd519dba93398c97ac14ed5b9a Mon Sep 17 00:00:00 2001
From: Zbynek Roubalik <zroubalik@gmail.com>
Date: Mon, 7 Sep 2026 18:44:24 +0200
Subject: [PATCH 02/10] ci: pin analyzer packaging actions

Signed-off-by: Zbynek Roubalik <zroubalik@gmail.com>
---
 .github/workflows/pr-check.yaml | 6 +++---
 .github/workflows/release.yaml  | 6 +++---
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/pr-check.yaml b/.github/workflows/pr-check.yaml
index 6987c62..7f4b530 100644
--- a/.github/workflows/pr-check.yaml
+++ b/.github/workflows/pr-check.yaml
@@ -19,15 +19,15 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Set up Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
         with:
           go-version-file: go.mod
 
       - name: Build snapshot archives
-        uses: goreleaser/goreleaser-action@v7
+        uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7
         with:
           distribution: goreleaser
           version: "~> v2"
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 765fc19..c291624 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -15,17 +15,17 @@ jobs:
       contents: write
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           fetch-depth: 0
 
       - name: Set up Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
         with:
           go-version-file: go.mod
 
       - name: Release
-        uses: goreleaser/goreleaser-action@v7
+        uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7
         with:
           distribution: goreleaser
           version: "~> v2"

From ec146348fa6ad8bc299f99ee51dde4c584a6ddcb Mon Sep 17 00:00:00 2001
From: Zbynek Roubalik <zroubalik@gmail.com>
Date: Mon, 7 Sep 2026 18:45:48 +0200
Subject: [PATCH 03/10] ci: isolate analyzer packaging check

Signed-off-by: Zbynek Roubalik <zroubalik@gmail.com>
---
 .github/workflows/package.yaml  | 28 ++++++++++++++++++++++++++++
 .github/workflows/pr-check.yaml | 19 -------------------
 2 files changed, 28 insertions(+), 19 deletions(-)
 create mode 100644 .github/workflows/package.yaml

diff --git a/.github/workflows/package.yaml b/.github/workflows/package.yaml
new file mode 100644
index 0000000..0c8709f
--- /dev/null
+++ b/.github/workflows/package.yaml
@@ -0,0 +1,28 @@
+name: Package analyzer
+
+on:
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  package:
+    name: Build release artifacts
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+
+      - name: Set up Go
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
+        with:
+          go-version-file: go.mod
+
+      - name: Build snapshot archives
+        uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7
+        with:
+          distribution: goreleaser
+          version: "~> v2"
+          args: release --snapshot --clean
diff --git a/.github/workflows/pr-check.yaml b/.github/workflows/pr-check.yaml
index 7f4b530..b29b8ab 100644
--- a/.github/workflows/pr-check.yaml
+++ b/.github/workflows/pr-check.yaml
@@ -13,22 +13,3 @@ jobs:
     with:
       continue_on_error: false
       skip_private_key_setup: true
-
-  package:
-    name: Build release artifacts
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-
-      - name: Set up Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
-        with:
-          go-version-file: go.mod
-
-      - name: Build snapshot archives
-        uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7
-        with:
-          distribution: goreleaser
-          version: "~> v2"
-          args: release --snapshot --clean

From 70ced3bc2715af5a3e02e4f17f190cb28444f647 Mon Sep 17 00:00:00 2001
From: Zbynek Roubalik <zroubalik@gmail.com>
Date: Mon, 7 Sep 2026 18:47:59 +0200
Subject: [PATCH 04/10] ci: grant reusable checks required permissions

Signed-off-by: Zbynek Roubalik <zroubalik@gmail.com>
---
 .github/workflows/pr-check.yaml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.github/workflows/pr-check.yaml b/.github/workflows/pr-check.yaml
index b29b8ab..91e849b 100644
--- a/.github/workflows/pr-check.yaml
+++ b/.github/workflows/pr-check.yaml
@@ -5,7 +5,11 @@ on:
     branches: [main]
 
 permissions:
+  actions: read
+  checks: write
   contents: read
+  pull-requests: read
+  security-events: write
 
 jobs:
   build-and-test:

From 918ce6449aaca6c41998c4e7a7a366f824595ca8 Mon Sep 17 00:00:00 2001
From: Zbynek Roubalik <zroubalik@gmail.com>
Date: Mon, 7 Sep 2026 18:50:35 +0200
Subject: [PATCH 05/10] fix: bound analyzer input

Signed-off-by: Zbynek Roubalik <zroubalik@gmail.com>
---
 README.md                        |  4 +++-
 cmd/kedify-analyzer/main.go      | 15 ++++++++++++++-
 cmd/kedify-analyzer/main_test.go | 10 ++++++++++
 3 files changed, 27 insertions(+), 2 deletions(-)

diff --git a/README.md b/README.md
index 666ca0a..5fcfa16 100644
--- a/README.md
+++ b/README.md
@@ -56,7 +56,9 @@ response. The current request contract is:
 The response contains `protocolVersion`, `analyzerVersion`, `engineVersion`,
 `inputSchemaVersion`, `outputSchemaVersion`, and the engine `output`. Only the exact
 `kedify-analyzer/v1` protocol is accepted. The engine validates its input schema and
-policy; there is no compatibility conversion in the executable.
+policy; there is no compatibility conversion in the executable. CPU
+`aggregatedUsage` must already reflect the policy's `max` or `percentile` selection.
+Requests larger than 16 MiB are rejected before decoding.
 
 Exit codes are stable for this protocol:
 
diff --git a/cmd/kedify-analyzer/main.go b/cmd/kedify-analyzer/main.go
index a4af5c7..ea3fb43 100644
--- a/cmd/kedify-analyzer/main.go
+++ b/cmd/kedify-analyzer/main.go
@@ -1,6 +1,7 @@
 package main
 
 import (
+	"bytes"
 	"encoding/json"
 	"fmt"
 	"io"
@@ -11,6 +12,8 @@ import (
 
 const (
 	protocolVersion = "kedify-analyzer/v1"
+	// Keep one local snapshot request bounded without constraining normal cluster inputs.
+	maxRequestBytes = 16 << 20
 	exitSuccess     = 0
 	exitInternal    = 1
 	exitInvalid     = 2
@@ -38,7 +41,17 @@ func main() {
 }
 
 func run(stdin io.Reader, stdout, stderr io.Writer) int {
-	decoder := json.NewDecoder(stdin)
+	requestBytes, err := io.ReadAll(io.LimitReader(stdin, maxRequestBytes+1))
+	if err != nil {
+		fmt.Fprintf(stderr, "kedify-analyzer: unable to read request: %v\n", err)
+		return exitInvalid
+	}
+	if len(requestBytes) > maxRequestBytes {
+		fmt.Fprintf(stderr, "kedify-analyzer: request exceeds %d-byte limit\n", maxRequestBytes)
+		return exitInvalid
+	}
+
+	decoder := json.NewDecoder(bytes.NewReader(requestBytes))
 	decoder.DisallowUnknownFields()
 
 	var req request
diff --git a/cmd/kedify-analyzer/main_test.go b/cmd/kedify-analyzer/main_test.go
index 44e089a..2ac552f 100644
--- a/cmd/kedify-analyzer/main_test.go
+++ b/cmd/kedify-analyzer/main_test.go
@@ -81,6 +81,16 @@ func TestAnalyzerExecutable(t *testing.T) {
 			}
 		})
 	}
+
+	t.Run("oversized input", func(t *testing.T) {
+		result := executeAnalyzer(t, binary, bytes.Repeat([]byte(" "), maxRequestBytes+1), exitInvalid)
+		if len(result.stdout) != 0 {
+			t.Fatalf("oversized request wrote machine output: %s", result.stdout)
+		}
+		if !strings.Contains(string(result.stderr), "request exceeds 16777216-byte limit") {
+			t.Fatalf("unexpected stderr: %s", result.stderr)
+		}
+	})
 }
 
 func TestRunReturnsInternalErrorWhenResponseCannotBeWritten(t *testing.T) {

From 1cd6fef6ee0464e5bc868804f3357170ded7869f Mon Sep 17 00:00:00 2001
From: Zbynek Roubalik <zroubalik@gmail.com>
Date: Mon, 7 Sep 2026 18:53:01 +0200
Subject: [PATCH 06/10] fix: harden analyzer execution and release

Signed-off-by: Zbynek Roubalik <zroubalik@gmail.com>
---
 .github/workflows/package.yaml   |  4 +++-
 .github/workflows/release.yaml   |  4 ++--
 cmd/kedify-analyzer/main.go      | 18 +++++++++++-------
 cmd/kedify-analyzer/main_test.go |  1 +
 4 files changed, 17 insertions(+), 10 deletions(-)

diff --git a/.github/workflows/package.yaml b/.github/workflows/package.yaml
index 0c8709f..c7aed0c 100644
--- a/.github/workflows/package.yaml
+++ b/.github/workflows/package.yaml
@@ -14,6 +14,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          fetch-depth: 0
 
       - name: Set up Go
         uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
@@ -24,5 +26,5 @@ jobs:
         uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7
         with:
           distribution: goreleaser
-          version: "~> v2"
+          version: v2.17.0
           args: release --snapshot --clean
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index c291624..01d7c67 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -3,7 +3,7 @@ name: Release analyzer
 on:
   push:
     tags:
-      - "v*"
+      - "v[0-9]*.[0-9]*.[0-9]*"
 
 permissions:
   contents: read
@@ -28,7 +28,7 @@ jobs:
         uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7
         with:
           distribution: goreleaser
-          version: "~> v2"
+          version: v2.17.0
           args: release --clean
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/cmd/kedify-analyzer/main.go b/cmd/kedify-analyzer/main.go
index ea3fb43..938cef5 100644
--- a/cmd/kedify-analyzer/main.go
+++ b/cmd/kedify-analyzer/main.go
@@ -43,11 +43,11 @@ func main() {
 func run(stdin io.Reader, stdout, stderr io.Writer) int {
 	requestBytes, err := io.ReadAll(io.LimitReader(stdin, maxRequestBytes+1))
 	if err != nil {
-		fmt.Fprintf(stderr, "kedify-analyzer: unable to read request: %v\n", err)
+		writeDiagnostic(stderr, "unable to read request: %v", err)
 		return exitInvalid
 	}
 	if len(requestBytes) > maxRequestBytes {
-		fmt.Fprintf(stderr, "kedify-analyzer: request exceeds %d-byte limit\n", maxRequestBytes)
+		writeDiagnostic(stderr, "request exceeds %d-byte limit", maxRequestBytes)
 		return exitInvalid
 	}
 
@@ -56,21 +56,21 @@ func run(stdin io.Reader, stdout, stderr io.Writer) int {
 
 	var req request
 	if err := decoder.Decode(&req); err != nil {
-		fmt.Fprintf(stderr, "kedify-analyzer: invalid request: %v\n", err)
+		writeDiagnostic(stderr, "invalid request: %v", err)
 		return exitInvalid
 	}
 	if err := decoder.Decode(&struct{}{}); err != io.EOF {
-		fmt.Fprintln(stderr, "kedify-analyzer: invalid request: expected one JSON object")
+		writeDiagnostic(stderr, "invalid request: expected one JSON object")
 		return exitInvalid
 	}
 	if req.ProtocolVersion != protocolVersion {
-		fmt.Fprintf(stderr, "kedify-analyzer: unsupported protocolVersion %q; expected %q\n", req.ProtocolVersion, protocolVersion)
+		writeDiagnostic(stderr, "unsupported protocolVersion %q; expected %q", req.ProtocolVersion, protocolVersion)
 		return exitInvalid
 	}
 
 	output, err := analysis.Analyze(req.Input, req.Policy)
 	if err != nil {
-		fmt.Fprintf(stderr, "kedify-analyzer: analysis failed: %v\n", err)
+		writeDiagnostic(stderr, "analysis failed: %v", err)
 		return exitInvalid
 	}
 
@@ -83,8 +83,12 @@ func run(stdin io.Reader, stdout, stderr io.Writer) int {
 		Output:              output,
 	}
 	if err := json.NewEncoder(stdout).Encode(result); err != nil {
-		fmt.Fprintf(stderr, "kedify-analyzer: unable to write response: %v\n", err)
+		writeDiagnostic(stderr, "unable to write response: %v", err)
 		return exitInternal
 	}
 	return exitSuccess
 }
+
+func writeDiagnostic(stderr io.Writer, format string, args ...any) {
+	_, _ = fmt.Fprintf(stderr, "kedify-analyzer: "+format+"\n", args...)
+}
diff --git a/cmd/kedify-analyzer/main_test.go b/cmd/kedify-analyzer/main_test.go
index 2ac552f..8794dbb 100644
--- a/cmd/kedify-analyzer/main_test.go
+++ b/cmd/kedify-analyzer/main_test.go
@@ -67,6 +67,7 @@ func TestAnalyzerExecutable(t *testing.T) {
 		{name: "missing schema", input: `{"protocolVersion":"kedify-analyzer/v1"}`, stderr: `unsupported input schema version ""`},
 		{name: "incompatible schema", input: `{"protocolVersion":"kedify-analyzer/v1","input":{"schemaVersion":"resource-analysis-input/v2"}}`, stderr: `unsupported input schema version "resource-analysis-input/v2"`},
 		{name: "invalid analysis input", input: `{"protocolVersion":"kedify-analyzer/v1","input":{"schemaVersion":"resource-analysis-input/v1"}}`, stderr: `observedIntervalHours must be greater than 0`},
+		{name: "invalid policy", input: `{"protocolVersion":"kedify-analyzer/v1","input":{"schemaVersion":"resource-analysis-input/v1","observedIntervalHours":1},"policy":{"cpu":{"headroomCoefficient":-1}}}`, stderr: `cpu.headroomCoefficient must be greater than 0`},
 		{name: "unknown field", input: `{"protocolVersion":"kedify-analyzer/v1","unexpected":true}`, stderr: `unknown field "unexpected"`},
 		{name: "malformed JSON", input: `{"protocolVersion":`, stderr: `invalid request`},
 	}

From ee283ae3fea0534f41652e86657435a6a4af9dd6 Mon Sep 17 00:00:00 2001
From: Zbynek Roubalik <zroubalik@gmail.com>
Date: Mon, 7 Sep 2026 18:54:03 +0200
Subject: [PATCH 07/10] ci: document release workflow constraints

Signed-off-by: Zbynek Roubalik <zroubalik@gmail.com>
---
 .github/workflows/package.yaml  | 2 +-
 .github/workflows/pr-check.yaml | 1 +
 .github/workflows/release.yaml  | 4 ++--
 3 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/package.yaml b/.github/workflows/package.yaml
index c7aed0c..9b28ad9 100644
--- a/.github/workflows/package.yaml
+++ b/.github/workflows/package.yaml
@@ -26,5 +26,5 @@ jobs:
         uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7
         with:
           distribution: goreleaser
-          version: v2.17.0
+          version: v2.18.1
           args: release --snapshot --clean
diff --git a/.github/workflows/pr-check.yaml b/.github/workflows/pr-check.yaml
index 91e849b..87a5ba2 100644
--- a/.github/workflows/pr-check.yaml
+++ b/.github/workflows/pr-check.yaml
@@ -4,6 +4,7 @@ on:
   pull_request:
     branches: [main]
 
+# Required by the pinned reusable workflow for PR annotations and SARIF upload.
 permissions:
   actions: read
   checks: write
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 01d7c67..f58be06 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -3,7 +3,7 @@ name: Release analyzer
 on:
   push:
     tags:
-      - "v[0-9]*.[0-9]*.[0-9]*"
+      - "v*"
 
 permissions:
   contents: read
@@ -28,7 +28,7 @@ jobs:
         uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7
         with:
           distribution: goreleaser
-          version: v2.17.0
+          version: v2.18.1
           args: release --clean
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

From 93480c8ec271ea87e2d80d5b334058dbc854131d Mon Sep 17 00:00:00 2001
From: Zbynek Roubalik <zroubalik@gmail.com>
Date: Mon, 7 Sep 2026 19:01:20 +0200
Subject: [PATCH 08/10] fix: classify analyzer input read failures

Signed-off-by: Zbynek Roubalik <zroubalik@gmail.com>
---
 README.md                        |  2 +-
 cmd/kedify-analyzer/main.go      |  2 +-
 cmd/kedify-analyzer/main_test.go | 19 +++++++++++++++++++
 3 files changed, 21 insertions(+), 2 deletions(-)

diff --git a/README.md b/README.md
index 5fcfa16..176a4d7 100644
--- a/README.md
+++ b/README.md
@@ -65,7 +65,7 @@ Exit codes are stable for this protocol:
 | Code | Meaning |
 | ---: | --- |
 | `0` | Analysis completed and a response was written. |
-| `1` | The analyzer could not write its response. |
+| `1` | The analyzer could not read its request or write its response. |
 | `2` | The request, protocol, schema, policy, or normalized input is invalid. |
 
 Release archives include the following executables:
diff --git a/cmd/kedify-analyzer/main.go b/cmd/kedify-analyzer/main.go
index 938cef5..fa3ee17 100644
--- a/cmd/kedify-analyzer/main.go
+++ b/cmd/kedify-analyzer/main.go
@@ -44,7 +44,7 @@ func run(stdin io.Reader, stdout, stderr io.Writer) int {
 	requestBytes, err := io.ReadAll(io.LimitReader(stdin, maxRequestBytes+1))
 	if err != nil {
 		writeDiagnostic(stderr, "unable to read request: %v", err)
-		return exitInvalid
+		return exitInternal
 	}
 	if len(requestBytes) > maxRequestBytes {
 		writeDiagnostic(stderr, "request exceeds %d-byte limit", maxRequestBytes)
diff --git a/cmd/kedify-analyzer/main_test.go b/cmd/kedify-analyzer/main_test.go
index 8794dbb..8e07c82 100644
--- a/cmd/kedify-analyzer/main_test.go
+++ b/cmd/kedify-analyzer/main_test.go
@@ -104,6 +104,19 @@ func TestRunReturnsInternalErrorWhenResponseCannotBeWritten(t *testing.T) {
 	}
 }
 
+func TestRunReturnsInternalErrorWhenRequestCannotBeRead(t *testing.T) {
+	var stdout, stderr bytes.Buffer
+	if code := run(errorReader{}, &stdout, &stderr); code != exitInternal {
+		t.Fatalf("run() = %d, want %d", code, exitInternal)
+	}
+	if stdout.Len() != 0 {
+		t.Fatalf("read failure wrote machine output: %s", stdout.String())
+	}
+	if !strings.Contains(stderr.String(), "unable to read request") {
+		t.Fatalf("unexpected stderr: %s", stderr.String())
+	}
+}
+
 func validRequest(t *testing.T) []byte {
 	t.Helper()
 	inputBytes, err := os.ReadFile("../../analysis/testdata/default-input.json")
@@ -153,3 +166,9 @@ type errorWriter struct{}
 func (errorWriter) Write([]byte) (int, error) {
 	return 0, errors.New("write failed")
 }
+
+type errorReader struct{}
+
+func (errorReader) Read([]byte) (int, error) {
+	return 0, errors.New("read failed")
+}

From 08efeb1bfa74bf463208cb8233963d95f6312fde Mon Sep 17 00:00:00 2001
From: Zbynek Roubalik <zroubalik@gmail.com>
Date: Tue, 8 Sep 2026 12:30:28 +0200
Subject: [PATCH 09/10] Prepare analysis engine for public consumers

Signed-off-by: Zbynek Roubalik <zroubalik@gmail.com>
---
 .github/workflows/package.yaml             |  30 ---
 .github/workflows/pr-check.yaml            |  86 ++++++++-
 .github/workflows/release.yaml             |  34 ----
 .github/workflows/repo-backup-template.yml | 110 +++++++++++
 .github/workflows/repo-backup.yml          |   6 +-
 .gitignore                                 |   1 -
 .goreleaser.yaml                           |  48 -----
 LICENSE                                    | 201 +++++++++++++++++++++
 README.md                                  |  97 +++-------
 cmd/kedify-analyzer/main.go                |  94 ----------
 cmd/kedify-analyzer/main_test.go           | 174 ------------------
 11 files changed, 423 insertions(+), 458 deletions(-)
 delete mode 100644 .github/workflows/package.yaml
 delete mode 100644 .github/workflows/release.yaml
 create mode 100644 .github/workflows/repo-backup-template.yml
 delete mode 100644 .gitignore
 delete mode 100644 .goreleaser.yaml
 create mode 100644 LICENSE
 delete mode 100644 cmd/kedify-analyzer/main.go
 delete mode 100644 cmd/kedify-analyzer/main_test.go

diff --git a/.github/workflows/package.yaml b/.github/workflows/package.yaml
deleted file mode 100644
index 9b28ad9..0000000
--- a/.github/workflows/package.yaml
+++ /dev/null
@@ -1,30 +0,0 @@
-name: Package analyzer
-
-on:
-  pull_request:
-    branches: [main]
-
-permissions:
-  contents: read
-
-jobs:
-  package:
-    name: Build release artifacts
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          fetch-depth: 0
-
-      - name: Set up Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
-        with:
-          go-version-file: go.mod
-
-      - name: Build snapshot archives
-        uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7
-        with:
-          distribution: goreleaser
-          version: v2.18.1
-          args: release --snapshot --clean
diff --git a/.github/workflows/pr-check.yaml b/.github/workflows/pr-check.yaml
index 87a5ba2..f320498 100644
--- a/.github/workflows/pr-check.yaml
+++ b/.github/workflows/pr-check.yaml
@@ -4,7 +4,6 @@ on:
   pull_request:
     branches: [main]
 
-# Required by the pinned reusable workflow for PR annotations and SARIF upload.
 permissions:
   actions: read
   checks: write
@@ -14,7 +13,84 @@ permissions:
 
 jobs:
   build-and-test:
-    uses: kedify/github-meta/.github/workflows/go-pr-check.yaml@c9332258ab5bbe61f19115c3b4542fe18ff747fb
-    with:
-      continue_on_error: false
-      skip_private_key_setup: true
+    name: Run PR Checks
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+
+      - name: Set up Go
+        uses: actions/setup-go@v6
+        with:
+          go-version-file: go.mod
+
+      - name: Verify dependencies
+        run: |
+          set -euo pipefail
+          go mod verify
+          go mod tidy
+          gofmt -s -w .
+          if [[ -n "$(git status --porcelain)" ]]; then
+            echo "dirty repository"
+            git status
+            exit 1
+          fi
+
+      - name: Run go vet
+        run: go vet ./...
+
+      - name: Run golangci-lint
+        uses: golangci/golangci-lint-action@v9.2.1
+        with:
+          version: v2.12.2
+          args: --timeout=10m
+
+      - name: Run staticcheck
+        uses: dominikh/staticcheck-action@v1
+        with:
+          version: v0.8.0
+          install-go: false
+
+      - name: Run vulncheck
+        run: |
+          go install golang.org/x/vuln/cmd/govulncheck@v1.6.0
+          echo -e "### vulncheck\n\n" >> "$GITHUB_STEP_SUMMARY"
+          echo '```' >> "$GITHUB_STEP_SUMMARY"
+          (govulncheck -scan package ./... || true) | tee -a "$GITHUB_STEP_SUMMARY"
+          echo '```' >> "$GITHUB_STEP_SUMMARY"
+
+      - name: Run Gosec Security Scanner
+        uses: securego/gosec@v2.24.7
+        with:
+          args: '-no-fail -fmt sarif -out results.sarif ./...'
+
+      - name: Normalize SARIF for GitHub upload
+        run: |
+          jq '
+            (.runs[]?.tool.driver.rules[]?) |=
+              (if has("relationships") then
+                if (.relationships | type) == "array" then
+                  .relationships |= map(select(type == "object"))
+                else
+                  del(.relationships)
+                end
+              else
+                .
+              end)
+          ' results.sarif > results.normalized.sarif
+          mv results.normalized.sarif results.sarif
+
+      - name: Upload SARIF file
+        uses: github/codeql-action/upload-sarif@v4
+        with:
+          sarif_file: results.sarif
+
+      - name: Build
+        env:
+          CGO_ENABLED: 0
+        run: make build
+
+      - name: Test
+        run: make test
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
deleted file mode 100644
index f58be06..0000000
--- a/.github/workflows/release.yaml
+++ /dev/null
@@ -1,34 +0,0 @@
-name: Release analyzer
-
-on:
-  push:
-    tags:
-      - "v*"
-
-permissions:
-  contents: read
-
-jobs:
-  release:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-    steps:
-      - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          fetch-depth: 0
-
-      - name: Set up Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
-        with:
-          go-version-file: go.mod
-
-      - name: Release
-        uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7
-        with:
-          distribution: goreleaser
-          version: v2.18.1
-          args: release --clean
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/repo-backup-template.yml b/.github/workflows/repo-backup-template.yml
new file mode 100644
index 0000000..07db655
--- /dev/null
+++ b/.github/workflows/repo-backup-template.yml
@@ -0,0 +1,110 @@
+# Reusable template workflow for backing up repositories to Google Cloud Storage
+# SOC 2 Compliance: Complete git repository backup using bare mirror clone preserving all branches, tags, and history
+# Required org secrets: GH_TOKEN (repo access), GCP_GH_BACKUP_SA_KEY (service account JSON key)
+
+#############################################################################################
+# WARNING:
+# UPDATE THIS FILE ONLY in kedify/github-meta/.github/workflows/repo-backup-template.yml
+#
+# Copy paste this file if needed to run from a public repo.
+############################################################################################
+
+name: "Repo Backup: backup repo to GCS"
+
+on:
+  workflow_call:
+    inputs:
+      bucket:
+        description: "GCS bucket name for backup storage (e.g. kedify-github-backups)"
+        required: true
+        type: string
+    secrets:
+      GH_TOKEN:
+        description: "Token used to clone the repository (map from caller's secrets.GITHUB_TOKEN or a PAT)"
+        required: true
+      GCP_SA_KEY:
+        description: "GCP Service Account JSON key for authentication"
+        required: true
+
+permissions:
+  contents: read
+
+jobs:
+  backup:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Authenticate to Google Cloud
+        uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
+        with:
+          credentials_json: ${{ secrets.GCP_SA_KEY }}
+
+      - name: Setup Google Cloud SDK
+        uses: google-github-actions/setup-gcloud@aa5489c8933f4cc7a4f7d45035b3b1440c9c10db # v3
+
+      - name: Verify required tools
+        run: |
+          set -euo pipefail
+          echo "Verifying required tools..."
+          command -v git >/dev/null || { echo "git not found"; exit 1; }
+          command -v tar >/dev/null || { echo "tar not found"; exit 1; }
+          command -v gsutil >/dev/null || { echo "gsutil not found"; exit 1; }
+          echo "All required tools available"
+
+      - name: Create git mirror backup
+        run: |
+          set -euo pipefail
+          DATE=$(date +%F)
+          REPO_FULL="${{ github.repository }}"
+          SANITIZED_REPO="${REPO_FULL//\//_}"
+          ARCHIVE_NAME="${SANITIZED_REPO}-${DATE}-${GITHUB_RUN_ID}.tar.gz"
+          echo "ARCHIVE_NAME=${ARCHIVE_NAME}" >> "$GITHUB_ENV"
+
+          TEMP_DIR=$(mktemp -d)
+          trap 'rm -rf "$TEMP_DIR" 2>/dev/null || true' EXIT
+          cd "$TEMP_DIR"
+
+          git config --global url."https://x-access-token:${{ secrets.GH_TOKEN }}@github.com/".insteadOf "https://github.com/"
+          git clone --mirror "https://github.com/${{ github.repository }}" repo.git
+
+          tar -czf "${ARCHIVE_NAME}" repo.git/
+          mv "${ARCHIVE_NAME}" "${GITHUB_WORKSPACE}/${ARCHIVE_NAME}"
+          ls -lh "${GITHUB_WORKSPACE}/${ARCHIVE_NAME}"
+          echo "✓ Git mirror backup created"
+
+      - name: Upload backup to GCS (daily + monthly snapshot handling)
+        shell: bash
+        env:
+          ARCHIVE_NAME: ${{ env.ARCHIVE_NAME }}
+        run: |
+          set -euo pipefail
+          ORG="${{ github.repository_owner }}"
+          REPO_NAME=$(basename "${{ github.repository }}")
+          BUCKET="${{ inputs.bucket }}"
+
+          DAILY_PATH="gs://${BUCKET}/daily/${ORG}/${REPO_NAME}/"
+          MONTHLY_PATH="gs://${BUCKET}/monthly/${ORG}/${REPO_NAME}/"
+
+          echo "Uploading ${GITHUB_WORKSPACE}/${ARCHIVE_NAME} -> ${DAILY_PATH}"
+          gsutil cp "${GITHUB_WORKSPACE}/${ARCHIVE_NAME}" "${DAILY_PATH}"
+
+          if gsutil -q stat "${DAILY_PATH}${ARCHIVE_NAME}"; then
+            echo "✓ Daily backup uploaded: ${DAILY_PATH}${ARCHIVE_NAME}"
+          else
+            echo "✗ Failed to validate daily upload"
+            gsutil ls -l "${DAILY_PATH}"
+            exit 1
+          fi
+
+          DAY_OF_MONTH=$(date +%d)
+          if [ "$DAY_OF_MONTH" = "01" ]; then
+            echo "First of month — creating monthly snapshot copy -> ${MONTHLY_PATH}"
+            gsutil cp "${GITHUB_WORKSPACE}/${ARCHIVE_NAME}" "${MONTHLY_PATH}"
+
+            if gsutil -q stat "${MONTHLY_PATH}${ARCHIVE_NAME}"; then
+              echo "✓ Monthly snapshot uploaded: ${MONTHLY_PATH}${ARCHIVE_NAME}"
+            else
+              echo "✗ Failed to validate monthly snapshot upload"
+              gsutil ls -l "${MONTHLY_PATH}"
+              exit 1
+            fi
+          fi
diff --git a/.github/workflows/repo-backup.yml b/.github/workflows/repo-backup.yml
index 0e3e535..24aedfe 100644
--- a/.github/workflows/repo-backup.yml
+++ b/.github/workflows/repo-backup.yml
@@ -3,7 +3,7 @@
 # Triggers daily at 02:00 UTC, supports manual dispatch for testing
 
 #############################################################################################
-# WARNING: 
+# WARNING:
 # UPDATE THIS FILE ONLY in kedify/github-meta/.github/workflows/repo-backup.yml
 #
 # THE ONLY EXCEPTION is the PRIVATE / PUBLIC REPO distinction below.
@@ -21,9 +21,9 @@ on:
 jobs:
   backup:
     # PRIVATE REPOS: Reuse the backup workflow defined in the github-meta repo
-    uses: kedify/github-meta/.github/workflows/repo-backup-template.yml@main
+    # uses: kedify/github-meta/.github/workflows/repo-backup-template.yml@main
     # PUBLIC REPOS: Copy and reference the template from github-meta repo directly here
-    # uses: ./.github/workflows/repo-backup-template.yml
+    uses: ./.github/workflows/repo-backup-template.yml
     with:
       bucket: kedify-github-backups
     secrets:
diff --git a/.gitignore b/.gitignore
deleted file mode 100644
index 178135c..0000000
--- a/.gitignore
+++ /dev/null
@@ -1 +0,0 @@
-/dist/
diff --git a/.goreleaser.yaml b/.goreleaser.yaml
deleted file mode 100644
index bceef9c..0000000
--- a/.goreleaser.yaml
+++ /dev/null
@@ -1,48 +0,0 @@
-version: 2
-
-project_name: kedify-analyzer
-
-builds:
-  - id: kedify-analyzer
-    main: ./cmd/kedify-analyzer
-    binary: kedify-analyzer
-    env:
-      - CGO_ENABLED=0
-    goos:
-      - linux
-      - darwin
-      - windows
-    goarch:
-      - amd64
-      - arm64
-    ignore:
-      - goos: windows
-        goarch: arm64
-    ldflags:
-      - -s -w -X main.version={{ .Version }}
-    mod_timestamp: "{{ .CommitTimestamp }}"
-
-archives:
-  - ids:
-      - kedify-analyzer
-    name_template: >-
-      {{ .ProjectName }}_{{ .Version }}_{{ .Os }}_{{ .Arch }}
-    formats:
-      - tar.gz
-    format_overrides:
-      - goos: windows
-        formats:
-          - zip
-
-checksum:
-  name_template: "{{ .ProjectName }}_{{ .Version }}_checksums.txt"
-
-release:
-  make_latest: true
-  prerelease: auto
-
-changelog:
-  use: git
-
-snapshot:
-  version_template: "{{ .Version }}-next"
diff --git a/LICENSE b/LICENSE
new file mode 100644
index 0000000..261eeb9
--- /dev/null
+++ b/LICENSE
@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
diff --git a/README.md b/README.md
index 176a4d7..42a61a7 100644
--- a/README.md
+++ b/README.md
@@ -1,86 +1,45 @@
 # Kedify Recommender
 
-This private Go module contains the pure resource recommendation calculations shared
-by Kedify services. It does not query metrics, call Kubernetes, serve HTTP, or store
-recommendations.
+This Go module contains the resource recommendation calculations shared by Kedify
+services and the Kedify CLI. It does not query metrics, call Kubernetes, serve
+HTTP, or store recommendations.
 
-The `analysis` package accepts normalized per-container observations and a policy. It
-returns deterministic CPU and memory request/limit recommendations together with the
-evidence and data quality used to produce them.
-
-Input/output schema versions describe the wire shape. The separate detector and
-effective-policy versions preserve recommendation identity across callers.
+The `analysis` package accepts normalized per-container observations and a policy.
+It returns deterministic CPU and memory request/limit recommendations together
+with the evidence and data quality used to produce them.
 
 ```go
+import "github.com/kedify/recommender/analysis"
+
 output, err := analysis.Analyze(snapshot, policy)
 ```
 
-Callers are responsible for collecting and aggregating observations. In particular,
-CPU `max` or `percentile` selection happens in the caller's metrics query or snapshot
-adapter; the normalized `aggregatedUsage` value must match the supplied policy.
-
-## Distribution
+Callers are responsible for collecting and aggregating observations. In
+particular, CPU `max` or `percentile` selection happens in the caller's metrics
+query or snapshot adapter; the normalized `aggregatedUsage` value must match the
+supplied policy.
 
-- `dashboard-api-service` imports this module and adapts stored Kedify telemetry or
-  Prometheus-compatible results to the normalized input.
-- `kedify-analyzer` packages the engine as a separate, network-free executable.
-- The public [`kedify/cli`](https://github.com/kedify/cli) does not import this
-  private module. Local analysis integration is tracked by
-  [`kedify/agent#618`](https://github.com/kedify/agent/issues/618) and
-  [`kedify/cli#14`](https://github.com/kedify/cli/issues/14).
+Input/output schema versions describe the data shape. The detector and effective
+policy versions preserve recommendation identity across callers. Consumers should
+pin a released module version and reject unsupported schemas instead of converting
+legacy input.
 
-## Local analyzer
+## Consumers
 
-Build and invoke the executable with a single JSON request on standard input:
+- [`dashboard-api-service`](https://github.com/kedify/dashboard-api-service)
+  adapts stored Kedify telemetry or Prometheus-compatible results to normalized
+  input.
+- [`kedify/cli`](https://github.com/kedify/cli) links the same package for local
+  and air-gapped analysis.
 
-```sh
-go build -o kedify-analyzer ./cmd/kedify-analyzer
-kedify-analyzer < request.json > response.json
-```
+## Development
 
-Diagnostics are written to standard error; standard output contains only the JSON
-response. The current request contract is:
+Run the tests with:
 
-```json
-{
-  "protocolVersion": "kedify-analyzer/v1",
-  "input": {
-    "schemaVersion": "resource-analysis-input/v1",
-    "observedIntervalHours": 24,
-    "containers": []
-  },
-  "policy": {}
-}
+```sh
+go test ./...
 ```
 
-The response contains `protocolVersion`, `analyzerVersion`, `engineVersion`,
-`inputSchemaVersion`, `outputSchemaVersion`, and the engine `output`. Only the exact
-`kedify-analyzer/v1` protocol is accepted. The engine validates its input schema and
-policy; there is no compatibility conversion in the executable. CPU
-`aggregatedUsage` must already reflect the policy's `max` or `percentile` selection.
-Requests larger than 16 MiB are rejected before decoding.
-
-Exit codes are stable for this protocol:
-
-| Code | Meaning |
-| ---: | --- |
-| `0` | Analysis completed and a response was written. |
-| `1` | The analyzer could not read its request or write its response. |
-| `2` | The request, protocol, schema, policy, or normalized input is invalid. |
-
-Release archives include the following executables:
-
-- Linux: `amd64`, `arm64`
-- macOS: `amd64`, `arm64`
-- Windows: `amd64`
-
-Consumers should prefer an explicitly configured analyzer path, then a binary next
-to the consuming executable, and finally `kedify-analyzer` (`kedify-analyzer.exe`
-on Windows) on `PATH`. They must validate the returned protocol, engine, and schema
-versions they support. Public CLI discovery and invocation are implemented separately
-in [`kedify/cli#14`](https://github.com/kedify/cli/issues/14).
+## License
 
-For an air-gapped environment, download the matching platform archive and its
-`kedify-analyzer_<version>_checksums.txt` file in advance, verify the SHA-256 checksum,
-and copy the extracted executable to the configured location. The analyzer performs
-no network access and never downloads or updates itself.
+Licensed under the Apache License, Version 2.0. See [LICENSE](LICENSE).
diff --git a/cmd/kedify-analyzer/main.go b/cmd/kedify-analyzer/main.go
deleted file mode 100644
index fa3ee17..0000000
--- a/cmd/kedify-analyzer/main.go
+++ /dev/null
@@ -1,94 +0,0 @@
-package main
-
-import (
-	"bytes"
-	"encoding/json"
-	"fmt"
-	"io"
-	"os"
-
-	"github.com/kedify/recommender/analysis"
-)
-
-const (
-	protocolVersion = "kedify-analyzer/v1"
-	// Keep one local snapshot request bounded without constraining normal cluster inputs.
-	maxRequestBytes = 16 << 20
-	exitSuccess     = 0
-	exitInternal    = 1
-	exitInvalid     = 2
-)
-
-var version = "dev"
-
-type request struct {
-	ProtocolVersion string          `json:"protocolVersion"`
-	Input           analysis.Input  `json:"input"`
-	Policy          analysis.Policy `json:"policy"`
-}
-
-type response struct {
-	ProtocolVersion     string          `json:"protocolVersion"`
-	AnalyzerVersion     string          `json:"analyzerVersion"`
-	EngineVersion       string          `json:"engineVersion"`
-	InputSchemaVersion  string          `json:"inputSchemaVersion"`
-	OutputSchemaVersion string          `json:"outputSchemaVersion"`
-	Output              analysis.Output `json:"output"`
-}
-
-func main() {
-	os.Exit(run(os.Stdin, os.Stdout, os.Stderr))
-}
-
-func run(stdin io.Reader, stdout, stderr io.Writer) int {
-	requestBytes, err := io.ReadAll(io.LimitReader(stdin, maxRequestBytes+1))
-	if err != nil {
-		writeDiagnostic(stderr, "unable to read request: %v", err)
-		return exitInternal
-	}
-	if len(requestBytes) > maxRequestBytes {
-		writeDiagnostic(stderr, "request exceeds %d-byte limit", maxRequestBytes)
-		return exitInvalid
-	}
-
-	decoder := json.NewDecoder(bytes.NewReader(requestBytes))
-	decoder.DisallowUnknownFields()
-
-	var req request
-	if err := decoder.Decode(&req); err != nil {
-		writeDiagnostic(stderr, "invalid request: %v", err)
-		return exitInvalid
-	}
-	if err := decoder.Decode(&struct{}{}); err != io.EOF {
-		writeDiagnostic(stderr, "invalid request: expected one JSON object")
-		return exitInvalid
-	}
-	if req.ProtocolVersion != protocolVersion {
-		writeDiagnostic(stderr, "unsupported protocolVersion %q; expected %q", req.ProtocolVersion, protocolVersion)
-		return exitInvalid
-	}
-
-	output, err := analysis.Analyze(req.Input, req.Policy)
-	if err != nil {
-		writeDiagnostic(stderr, "analysis failed: %v", err)
-		return exitInvalid
-	}
-
-	result := response{
-		ProtocolVersion:     protocolVersion,
-		AnalyzerVersion:     version,
-		EngineVersion:       analysis.ResourceRightSizeDetectorVersion,
-		InputSchemaVersion:  analysis.InputSchemaVersion,
-		OutputSchemaVersion: analysis.OutputSchemaVersion,
-		Output:              output,
-	}
-	if err := json.NewEncoder(stdout).Encode(result); err != nil {
-		writeDiagnostic(stderr, "unable to write response: %v", err)
-		return exitInternal
-	}
-	return exitSuccess
-}
-
-func writeDiagnostic(stderr io.Writer, format string, args ...any) {
-	_, _ = fmt.Fprintf(stderr, "kedify-analyzer: "+format+"\n", args...)
-}
diff --git a/cmd/kedify-analyzer/main_test.go b/cmd/kedify-analyzer/main_test.go
deleted file mode 100644
index 8e07c82..0000000
--- a/cmd/kedify-analyzer/main_test.go
+++ /dev/null
@@ -1,174 +0,0 @@
-package main
-
-import (
-	"bytes"
-	"encoding/json"
-	"errors"
-	"os"
-	"os/exec"
-	"path/filepath"
-	"reflect"
-	"runtime"
-	"strings"
-	"testing"
-
-	"github.com/kedify/recommender/analysis"
-)
-
-func TestAnalyzerExecutable(t *testing.T) {
-	binary := filepath.Join(t.TempDir(), "kedify-analyzer")
-	if runtime.GOOS == "windows" {
-		binary += ".exe"
-	}
-	build := exec.Command("go", "build", "-o", binary, ".")
-	if output, err := build.CombinedOutput(); err != nil {
-		t.Fatalf("build analyzer: %v\n%s", err, output)
-	}
-
-	requestBytes := validRequest(t)
-	first := executeAnalyzer(t, binary, requestBytes, exitSuccess)
-	second := executeAnalyzer(t, binary, requestBytes, exitSuccess)
-	if !bytes.Equal(first.stdout, second.stdout) {
-		t.Fatalf("same request produced different output\nfirst: %s\nsecond: %s", first.stdout, second.stdout)
-	}
-	if len(first.stderr) != 0 {
-		t.Fatalf("successful analysis wrote diagnostics: %s", first.stderr)
-	}
-
-	var got response
-	if err := json.Unmarshal(first.stdout, &got); err != nil {
-		t.Fatalf("decode response: %v", err)
-	}
-	if got.ProtocolVersion != protocolVersion || got.AnalyzerVersion != "dev" ||
-		got.EngineVersion != analysis.ResourceRightSizeDetectorVersion ||
-		got.InputSchemaVersion != analysis.InputSchemaVersion || got.OutputSchemaVersion != analysis.OutputSchemaVersion {
-		t.Fatalf("unexpected response metadata: %#v", got)
-	}
-
-	expectedBytes, err := os.ReadFile("../../analysis/testdata/default-output.json")
-	if err != nil {
-		t.Fatal(err)
-	}
-	var expected analysis.Output
-	if err := json.Unmarshal(expectedBytes, &expected); err != nil {
-		t.Fatal(err)
-	}
-	if !reflect.DeepEqual(got.Output, expected) {
-		t.Fatalf("analyzer output differs from engine fixture\ngot: %#v\nwant: %#v", got.Output, expected)
-	}
-
-	tests := []struct {
-		name   string
-		input  string
-		stderr string
-	}{
-		{name: "missing protocol", input: `{}`, stderr: `unsupported protocolVersion ""`},
-		{name: "incompatible protocol", input: `{"protocolVersion":"kedify-analyzer/v2"}`, stderr: `unsupported protocolVersion "kedify-analyzer/v2"`},
-		{name: "missing schema", input: `{"protocolVersion":"kedify-analyzer/v1"}`, stderr: `unsupported input schema version ""`},
-		{name: "incompatible schema", input: `{"protocolVersion":"kedify-analyzer/v1","input":{"schemaVersion":"resource-analysis-input/v2"}}`, stderr: `unsupported input schema version "resource-analysis-input/v2"`},
-		{name: "invalid analysis input", input: `{"protocolVersion":"kedify-analyzer/v1","input":{"schemaVersion":"resource-analysis-input/v1"}}`, stderr: `observedIntervalHours must be greater than 0`},
-		{name: "invalid policy", input: `{"protocolVersion":"kedify-analyzer/v1","input":{"schemaVersion":"resource-analysis-input/v1","observedIntervalHours":1},"policy":{"cpu":{"headroomCoefficient":-1}}}`, stderr: `cpu.headroomCoefficient must be greater than 0`},
-		{name: "unknown field", input: `{"protocolVersion":"kedify-analyzer/v1","unexpected":true}`, stderr: `unknown field "unexpected"`},
-		{name: "malformed JSON", input: `{"protocolVersion":`, stderr: `invalid request`},
-	}
-	for _, test := range tests {
-		t.Run(test.name, func(t *testing.T) {
-			result := executeAnalyzer(t, binary, []byte(test.input), exitInvalid)
-			if len(result.stdout) != 0 {
-				t.Fatalf("invalid request wrote machine output: %s", result.stdout)
-			}
-			if !strings.Contains(string(result.stderr), test.stderr) {
-				t.Fatalf("stderr = %q, want substring %q", result.stderr, test.stderr)
-			}
-		})
-	}
-
-	t.Run("oversized input", func(t *testing.T) {
-		result := executeAnalyzer(t, binary, bytes.Repeat([]byte(" "), maxRequestBytes+1), exitInvalid)
-		if len(result.stdout) != 0 {
-			t.Fatalf("oversized request wrote machine output: %s", result.stdout)
-		}
-		if !strings.Contains(string(result.stderr), "request exceeds 16777216-byte limit") {
-			t.Fatalf("unexpected stderr: %s", result.stderr)
-		}
-	})
-}
-
-func TestRunReturnsInternalErrorWhenResponseCannotBeWritten(t *testing.T) {
-	var stderr bytes.Buffer
-	if code := run(bytes.NewReader(validRequest(t)), errorWriter{}, &stderr); code != exitInternal {
-		t.Fatalf("run() = %d, want %d", code, exitInternal)
-	}
-	if !strings.Contains(stderr.String(), "unable to write response") {
-		t.Fatalf("unexpected stderr: %s", stderr.String())
-	}
-}
-
-func TestRunReturnsInternalErrorWhenRequestCannotBeRead(t *testing.T) {
-	var stdout, stderr bytes.Buffer
-	if code := run(errorReader{}, &stdout, &stderr); code != exitInternal {
-		t.Fatalf("run() = %d, want %d", code, exitInternal)
-	}
-	if stdout.Len() != 0 {
-		t.Fatalf("read failure wrote machine output: %s", stdout.String())
-	}
-	if !strings.Contains(stderr.String(), "unable to read request") {
-		t.Fatalf("unexpected stderr: %s", stderr.String())
-	}
-}
-
-func validRequest(t *testing.T) []byte {
-	t.Helper()
-	inputBytes, err := os.ReadFile("../../analysis/testdata/default-input.json")
-	if err != nil {
-		t.Fatal(err)
-	}
-	var input analysis.Input
-	if err := json.Unmarshal(inputBytes, &input); err != nil {
-		t.Fatal(err)
-	}
-	requestBytes, err := json.Marshal(request{ProtocolVersion: protocolVersion, Input: input})
-	if err != nil {
-		t.Fatal(err)
-	}
-	return requestBytes
-}
-
-type execution struct {
-	stdout []byte
-	stderr []byte
-}
-
-func executeAnalyzer(t *testing.T, binary string, input []byte, wantExit int) execution {
-	t.Helper()
-	cmd := exec.Command(binary)
-	cmd.Stdin = bytes.NewReader(input)
-	var stdout, stderr bytes.Buffer
-	cmd.Stdout = &stdout
-	cmd.Stderr = &stderr
-	err := cmd.Run()
-	gotExit := exitSuccess
-	if err != nil {
-		var exitError *exec.ExitError
-		if !errors.As(err, &exitError) {
-			t.Fatalf("execute analyzer: %v", err)
-		}
-		gotExit = exitError.ExitCode()
-	}
-	if gotExit != wantExit {
-		t.Fatalf("exit code = %d, want %d; stderr: %s", gotExit, wantExit, stderr.String())
-	}
-	return execution{stdout: stdout.Bytes(), stderr: stderr.Bytes()}
-}
-
-type errorWriter struct{}
-
-func (errorWriter) Write([]byte) (int, error) {
-	return 0, errors.New("write failed")
-}
-
-type errorReader struct{}
-
-func (errorReader) Read([]byte) (int, error) {
-	return 0, errors.New("read failed")
-}

From 4b9e3c683f3c77c476da482aa65b619fcf953bd0 Mon Sep 17 00:00:00 2001
From: Zbynek Roubalik <zroubalik@gmail.com>
Date: Tue, 8 Sep 2026 12:54:35 +0200
Subject: [PATCH 10/10] Pin public workflow dependencies

Signed-off-by: Zbynek Roubalik <zroubalik@gmail.com>
---
 .github/workflows/pr-check.yaml            | 12 ++++++------
 .github/workflows/repo-backup-template.yml |  2 +-
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/pr-check.yaml b/.github/workflows/pr-check.yaml
index f320498..b6ba248 100644
--- a/.github/workflows/pr-check.yaml
+++ b/.github/workflows/pr-check.yaml
@@ -17,12 +17,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           fetch-depth: 0
 
       - name: Set up Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
         with:
           go-version-file: go.mod
 
@@ -42,13 +42,13 @@ jobs:
         run: go vet ./...
 
       - name: Run golangci-lint
-        uses: golangci/golangci-lint-action@v9.2.1
+        uses: golangci/golangci-lint-action@82606bf257cbaff209d206a39f5134f0cfbfd2ee # v9.2.1
         with:
           version: v2.12.2
           args: --timeout=10m
 
       - name: Run staticcheck
-        uses: dominikh/staticcheck-action@v1
+        uses: dominikh/staticcheck-action@9716614d4101e79b4340dd97b10e54d68234e431 # v1
         with:
           version: v0.8.0
           install-go: false
@@ -62,7 +62,7 @@ jobs:
           echo '```' >> "$GITHUB_STEP_SUMMARY"
 
       - name: Run Gosec Security Scanner
-        uses: securego/gosec@v2.24.7
+        uses: securego/gosec@bb17e422fc34bf4c0a2e5cab9d07dc45a68c040c # v2.24.7
         with:
           args: '-no-fail -fmt sarif -out results.sarif ./...'
 
@@ -83,7 +83,7 @@ jobs:
           mv results.normalized.sarif results.sarif
 
       - name: Upload SARIF file
-        uses: github/codeql-action/upload-sarif@v4
+        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4
         with:
           sarif_file: results.sarif
 
diff --git a/.github/workflows/repo-backup-template.yml b/.github/workflows/repo-backup-template.yml
index 07db655..43477ad 100644
--- a/.github/workflows/repo-backup-template.yml
+++ b/.github/workflows/repo-backup-template.yml
@@ -1,6 +1,6 @@
 # Reusable template workflow for backing up repositories to Google Cloud Storage
 # SOC 2 Compliance: Complete git repository backup using bare mirror clone preserving all branches, tags, and history
-# Required org secrets: GH_TOKEN (repo access), GCP_GH_BACKUP_SA_KEY (service account JSON key)
+# Required workflow-call secrets: GH_TOKEN (repository token) and GCP_SA_KEY (service account JSON key)
 
 #############################################################################################
 # WARNING: