Button down security

Author: cevian

.github/CODEOWNERS

@@ -1 +1,2 @@
 * @timescale/ts-vector
+/.github/ @jgpruitt @cevian @avthars

.github/actions/install-pgrx/action.yml

@@ -39,7 +39,7 @@ runs:
 
     - name: Cache cargo-pgrx installation ${{ inputs.pgrx-version }}
       id: cache-cargo-pgrx
-      uses: actions/cache@v3
+      uses: actions/cache@v4
       with:
         path: ~/.cargo/bin/cargo-pgrx
         key: ${{runner.os}}-cargo-pgrx-${{ inputs.pgrx-version }}-pg${{ steps.pg-config.outputs.version }}-${{ steps.rustc.outputs.version }}
@@ -60,7 +60,7 @@ runs:
 
     - name: Cache cargo-grcov installation ${{ inputs.grcov-version }}
       id: cache-cargo-grcov
-      uses: actions/cache@v3
+      uses: actions/cache@v4
       with:
         path: ~/.cargo/bin/grcov
         key: ${{runner.os}}-cargo-grcov-${{ inputs.grcov-version }}-${{ steps.rustc.outputs.version }}

.github/actions/install-postgres/action.yml

@@ -15,7 +15,7 @@ runs:
   steps:
     - name: Cache PostgreSQL ${{ inputs.pg-version }}
       id: cache-postgresql
-      uses: actions/cache@v3
+      uses: actions/cache@v4
       with:
        path: ${{ inputs.pg-src-dir }}
        key: ${{ runner.os }}-postgresql-${{ inputs.pg-version }}

.github/matrix/dependencies.json

@@ -1,5 +1,8 @@
 name: Run code checks
 on: [push, pull_request, workflow_dispatch]
+permissions:
+  contents: read
+
 jobs:
   fmt:
     runs-on: ubuntu-latest
@@ -9,7 +12,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: Verify formatting
         run: cd pgvectorscale && cargo fmt --check

.github/workflows/code_checks.yml

@@ -30,7 +30,7 @@ jobs:
 
     steps:
     - name: Checkout pgvectorscale
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
 
     - name: Install Linux Packages
       uses: ./.github/actions/install-packages
@@ -69,7 +69,7 @@ jobs:
   # Use a GH artifact, then we can make use of the (quite limited) GH API https://docs.github.com/en/rest/actions/artifacts
   # The artifact will have a TTL of 90 days
     - name: Upload deb as Artifact
-      uses: actions/upload-artifact@v3
+      uses: actions/upload-artifact@v4
       with:
         name: vector-${{ env.TAG }}-pg${{ env.PG_VER }}
         path: pkgdump/pgvectorscale-*${{ env.TAG }}*.deb

.github/workflows/deb-packager.yaml

@@ -21,7 +21,7 @@ jobs:
           sudo apt-get install shellcheck
 
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: Run shellcheck
         run: |

.github/workflows/pr-validation.yaml

@@ -2,7 +2,7 @@
 
 DEBHELPER_COMPAT=11
 
-set -ex
+set -eux
 
 OS_NAME="${3}"
 BASEDIR="${2}"/pgvectorscale