Use double for all ok fields

[AlekSi]

No description provided.

To fix the issue, we need to add a permissions block to the workflow or job to explicitly limit the permissions of the GITHUB_TOKEN. Since the workflow only requires read access to repository contents, we can set contents: read at the job level. This ensures the workflow has the minimal permissions necessary to complete its tasks.

The changes will be made in the .github/workflows/ferretdb_go_tests.yml file:

1. Add a permissions block under the test job.
2. Set contents: read as the permission.

---

To fix the issue, the workflow should avoid executing untrusted code in the context of the default branch. This can be achieved by replacing the pull_request_target event with the pull_request event, which scopes the workflow to the pull request branch instead of the default branch. Additionally, any steps that rely on untrusted code should be isolated or validated to ensure they do not introduce security vulnerabilities. Specifically:

1. Replace pull_request_target with pull_request in the on section.
2. Remove or adjust steps that directly use untrusted code (e.g., checkout pull request code).
3. Validate any inputs derived from untrusted sources before using them in critical operations.

To fix the issue, the artifact should be extracted into a temporary directory instead of the packaging directory. This ensures that the artifact cannot override existing files. Additionally, the contents of the artifact should be verified before they are used. For example, if specific files are expected, their presence and integrity should be checked. This approach mitigates the risk of artifact poisoning.

To fix the artifact poisoning issue, the workflow should treat the downloaded artifact as untrusted and verify its contents before using it. Specifically:

1. Extract the artifact to a temporary directory to prevent it from overwriting existing files.
2. Verify the contents of the artifact to ensure they match the expected format or values.
3. Use the verified contents in subsequent steps.

The changes will involve modifying the artifact download step to specify a temporary directory and adding a verification step before using the artifact.

To fix the issue, the workflow should treat the artifact as untrusted and follow best practices for handling artifacts:

1. Extract the artifact into a temporary directory to prevent overwriting existing files.
2. Validate the contents of the artifact before using it in any commands.

Specifically:

• Modify the actions/download-artifact step to extract the artifact into a temporary directory.
• Add a validation step to ensure the artifact contents are as expected before proceeding with the make command.

To fix the issue, the workflow should treat the artifact as untrusted and isolate its contents in a temporary directory. Additionally, the contents of the artifact should be verified before use. This involves:

1. Creating a temporary directory for artifact extraction.
2. Modifying the actions/download-artifact step to extract the artifact into the temporary directory.
3. Adding a verification step to ensure the artifact's contents are as expected before proceeding with the Docker build.

To fix the artifact poisoning issue, the workflow should treat the downloaded artifact as untrusted and isolate its contents. Specifically:

1. Extract the artifact to a temporary directory to prevent overwriting existing files.
2. Verify the contents of the artifact before using them in subsequent steps.
3. Ensure that any untrusted inputs (e.g., matrix.pg and steps.version.outputs.debian_version) are sanitized or validated.

The changes will involve modifying the artifact download step to specify a temporary directory and adding a verification step to check the artifact's contents before proceeding.

[mergify]

@AlekSi this pull request has merge conflicts.