Prepare the analysis engine for public use

.github/workflows/pr-check.yaml

@@ -5,11 +5,92 @@ on:
     branches: [main]
 
 permissions:
+  actions: read
+  checks: write
   contents: read
+  pull-requests: read
+  security-events: write
 
 jobs:
   build-and-test:
-    uses: kedify/github-meta/.github/workflows/go-pr-check.yaml@c9332258ab5bbe61f19115c3b4542fe18ff747fb
-    with:
-      continue_on_error: false
-      skip_private_key_setup: true
+    name: Run PR Checks
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          fetch-depth: 0
+
+      - name: Set up Go
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
+        with:
+          go-version-file: go.mod
+
+      - name: Verify dependencies
+        run: |
+          set -euo pipefail
+          go mod verify
+          go mod tidy
+          gofmt -s -w .
+          if [[ -n "$(git status --porcelain)" ]]; then
+            echo "dirty repository"
+            git status
+            exit 1
+          fi
+
+      - name: Run go vet
+        run: go vet ./...
+
+      - name: Run golangci-lint
+        uses: golangci/golangci-lint-action@82606bf257cbaff209d206a39f5134f0cfbfd2ee # v9.2.1
+        with:
+          version: v2.12.2
+          args: --timeout=10m
+
+      - name: Run staticcheck
+        uses: dominikh/staticcheck-action@9716614d4101e79b4340dd97b10e54d68234e431 # v1
+        with:
+          version: v0.8.0
+          install-go: false
+
+      - name: Run vulncheck
+        run: |
+          go install golang.org/x/vuln/cmd/govulncheck@v1.6.0
+          echo -e "### vulncheck\n\n" >> "$GITHUB_STEP_SUMMARY"
+          echo '```' >> "$GITHUB_STEP_SUMMARY"
+          (govulncheck -scan package ./... || true) | tee -a "$GITHUB_STEP_SUMMARY"
+          echo '```' >> "$GITHUB_STEP_SUMMARY"
+
+      - name: Run Gosec Security Scanner
+        uses: securego/gosec@bb17e422fc34bf4c0a2e5cab9d07dc45a68c040c # v2.24.7
+        with:
+          args: '-no-fail -fmt sarif -out results.sarif ./...'
+
+      - name: Normalize SARIF for GitHub upload
+        run: |
+          jq '
+            (.runs[]?.tool.driver.rules[]?) |=
+              (if has("relationships") then
+                if (.relationships | type) == "array" then
+                  .relationships |= map(select(type == "object"))
+                else
+                  del(.relationships)
+                end
+              else
+                .
+              end)
+          ' results.sarif > results.normalized.sarif
+          mv results.normalized.sarif results.sarif
+
+      - name: Upload SARIF file
+        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4
+        with:
+          sarif_file: results.sarif
+
+      - name: Build
+        env:
+          CGO_ENABLED: 0
+        run: make build
+
+      - name: Test
+        run: make test

.github/workflows/repo-backup-template.yml

@@ -0,0 +1,110 @@
+# Reusable template workflow for backing up repositories to Google Cloud Storage
+# SOC 2 Compliance: Complete git repository backup using bare mirror clone preserving all branches, tags, and history
+# Required workflow-call secrets: GH_TOKEN (repository token) and GCP_SA_KEY (service account JSON key)
+
+#############################################################################################
+# WARNING:
+# UPDATE THIS FILE ONLY in kedify/github-meta/.github/workflows/repo-backup-template.yml
+#
+# Copy paste this file if needed to run from a public repo.
+############################################################################################
+
+name: "Repo Backup: backup repo to GCS"
+
+on:
+  workflow_call:
+    inputs:
+      bucket:
+        description: "GCS bucket name for backup storage (e.g. kedify-github-backups)"
+        required: true
+        type: string
+    secrets:
+      GH_TOKEN:
+        description: "Token used to clone the repository (map from caller's secrets.GITHUB_TOKEN or a PAT)"
+        required: true
+      GCP_SA_KEY:
+        description: "GCP Service Account JSON key for authentication"
+        required: true
+
+permissions:
+  contents: read
+
+jobs:
+  backup:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Authenticate to Google Cloud
+        uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
+        with:
+          credentials_json: ${{ secrets.GCP_SA_KEY }}
+
+      - name: Setup Google Cloud SDK
+        uses: google-github-actions/setup-gcloud@aa5489c8933f4cc7a4f7d45035b3b1440c9c10db # v3
+
+      - name: Verify required tools
+        run: |
+          set -euo pipefail
+          echo "Verifying required tools..."
+          command -v git >/dev/null || { echo "git not found"; exit 1; }
+          command -v tar >/dev/null || { echo "tar not found"; exit 1; }
+          command -v gsutil >/dev/null || { echo "gsutil not found"; exit 1; }
+          echo "All required tools available"
+
+      - name: Create git mirror backup
+        run: |
+          set -euo pipefail
+          DATE=$(date +%F)
+          REPO_FULL="${{ github.repository }}"
+          SANITIZED_REPO="${REPO_FULL//\//_}"
+          ARCHIVE_NAME="${SANITIZED_REPO}-${DATE}-${GITHUB_RUN_ID}.tar.gz"
+          echo "ARCHIVE_NAME=${ARCHIVE_NAME}" >> "$GITHUB_ENV"
+
+          TEMP_DIR=$(mktemp -d)
+          trap 'rm -rf "$TEMP_DIR" 2>/dev/null || true' EXIT
+          cd "$TEMP_DIR"
+
+          git config --global url."https://x-access-token:${{ secrets.GH_TOKEN }}@github.com/".insteadOf "https://github.com/"
+          git clone --mirror "https://github.com/${{ github.repository }}" repo.git
+
+          tar -czf "${ARCHIVE_NAME}" repo.git/
+          mv "${ARCHIVE_NAME}" "${GITHUB_WORKSPACE}/${ARCHIVE_NAME}"
+          ls -lh "${GITHUB_WORKSPACE}/${ARCHIVE_NAME}"
+          echo "✓ Git mirror backup created"
+
+      - name: Upload backup to GCS (daily + monthly snapshot handling)
+        shell: bash
+        env:
+          ARCHIVE_NAME: ${{ env.ARCHIVE_NAME }}
+        run: |
+          set -euo pipefail
+          ORG="${{ github.repository_owner }}"
+          REPO_NAME=$(basename "${{ github.repository }}")
+          BUCKET="${{ inputs.bucket }}"
+
+          DAILY_PATH="gs://${BUCKET}/daily/${ORG}/${REPO_NAME}/"
+          MONTHLY_PATH="gs://${BUCKET}/monthly/${ORG}/${REPO_NAME}/"
+
+          echo "Uploading ${GITHUB_WORKSPACE}/${ARCHIVE_NAME} -> ${DAILY_PATH}"
+          gsutil cp "${GITHUB_WORKSPACE}/${ARCHIVE_NAME}" "${DAILY_PATH}"
+
+          if gsutil -q stat "${DAILY_PATH}${ARCHIVE_NAME}"; then
+            echo "✓ Daily backup uploaded: ${DAILY_PATH}${ARCHIVE_NAME}"
+          else
+            echo "✗ Failed to validate daily upload"
+            gsutil ls -l "${DAILY_PATH}"
+            exit 1
+          fi
+
+          DAY_OF_MONTH=$(date +%d)
+          if [ "$DAY_OF_MONTH" = "01" ]; then
+            echo "First of month — creating monthly snapshot copy -> ${MONTHLY_PATH}"
+            gsutil cp "${GITHUB_WORKSPACE}/${ARCHIVE_NAME}" "${MONTHLY_PATH}"
+
+            if gsutil -q stat "${MONTHLY_PATH}${ARCHIVE_NAME}"; then
+              echo "✓ Monthly snapshot uploaded: ${MONTHLY_PATH}${ARCHIVE_NAME}"
+            else
+              echo "✗ Failed to validate monthly snapshot upload"
+              gsutil ls -l "${MONTHLY_PATH}"
+              exit 1
+            fi
+          fi

.github/workflows/repo-backup.yml

@@ -3,7 +3,7 @@
 # Triggers daily at 02:00 UTC, supports manual dispatch for testing
 
 #############################################################################################
-# WARNING: 
+# WARNING:
 # UPDATE THIS FILE ONLY in kedify/github-meta/.github/workflows/repo-backup.yml
 #
 # THE ONLY EXCEPTION is the PRIVATE / PUBLIC REPO distinction below.
@@ -21,9 +21,9 @@ on:
 jobs:
   backup:
     # PRIVATE REPOS: Reuse the backup workflow defined in the github-meta repo
-    uses: kedify/github-meta/.github/workflows/repo-backup-template.yml@main
+    # uses: kedify/github-meta/.github/workflows/repo-backup-template.yml@main
     # PUBLIC REPOS: Copy and reference the template from github-meta repo directly here
-    # uses: ./.github/workflows/repo-backup-template.yml
+    uses: ./.github/workflows/repo-backup-template.yml
     with:
       bucket: kedify-github-backups
     secrets: