ci: harden workflows and update references after repo migration

.claude-plugin/plugin.json

@@ -6,7 +6,7 @@
     "name": "Google LLC",
     "email": "data-cloud-ai-integrations@google.com"
   },
-  "repository": "https://github.com/gemini-cli-extensions/postgres",
+  "repository": "https://github.com/GoogleCloudPlatform/postgres-plugin",
   "license": "Apache-2.0",
   "userConfig": {
     "postgres_database": {

.codex-plugin/plugin.json

@@ -6,7 +6,7 @@
     "name": "Google LLC",
     "email": "data-cloud-ai-integrations@google.com"
   },
-  "repository": "https://github.com/gemini-cli-extensions/postgres",
+  "repository": "https://github.com/GoogleCloudPlatform/postgres-plugin",
   "license": "Apache-2.0",
   "mcpServers": "./.codex-plugin/.mcp.json"
 }

.github/CODEOWNERS

@@ -3,4 +3,4 @@
 # For syntax help see:
 # https://help.github.com/en/github/creating-cloning-and-archiving-repositories/about-code-owners#codeowners-syntax
 
-* @gemini-cli-extensions/senseai-eco @gemini-cli-extensions/postgres-maintainers
+* @GoogleCloudPlatform/senseai-eco @GoogleCloudPlatform/cloud-sql-postgresql-plugin-maintainers

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -30,7 +30,7 @@ body:
       label: Pre-reqs
       description: |
         Please run through the following list and make sure you've tried the usual "quick fixes":
-        - Search the [current open issues](https://github.com/gemini-cli-extensions/postgres/issues)
+        - Search the [current open issues](https://github.com/GoogleCloudPlatform/postgres-plugin/issues)
         - Update to the latest version of the extension and [Gemini CLI](https://github.com/google-gemini/gemini-cli?tab=readme-ov-file#stable)
       options: 
         - label: "I've searched the current open issues"

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -30,7 +30,7 @@ body:
       description: |
         Please run through the following list and make sure you've tried the usual "quick fixes":
       options:
-        - label: "Search the [current open issues](https://github.com/gemini-cli-extensions/postgres/issues)"
+        - label: "Search the [current open issues](https://github.com/GoogleCloudPlatform/postgres-plugin/issues)"
           required: true
 
   - type: textarea

.github/ISSUE_TEMPLATE/question.yml

@@ -30,7 +30,7 @@ body:
       description: |
         Please run through the following list and make sure you've tried the usual "quick fixes":
       options:
-        - label: "Search the [issues](https://github.com/gemini-cli-extensions/postgres/issues)"
+        - label: "Search the [issues](https://github.com/GoogleCloudPlatform/postgres-plugin/issues)"
           required: true
 
   - type: textarea

.github/workflows/assign-issues.yml

@@ -25,7 +25,7 @@ jobs:
       issues: write
     steps:
       - name: "Auto-assign issue"
-        uses: pozil/auto-assign-issue@v2
+        uses: pozil/auto-assign-issue@7bf9d82c77d45976224660b873fc83e60576c5aa # v2
         with:
           assignees: dolphin1999,isaurabhuttam,prernakakkar-google
           numOfAssignee: 1

.github/workflows/assign-prs.yml

@@ -15,8 +15,11 @@
 name: PR assignment
 
 on:
-  pull_request_target:
+  pull_request_target: # zizmor: ignore[dangerous-triggers] - needs write token on fork PRs; never checks out or runs PR code
     types: [opened, edited, reopened]
+    branches: [main]
+
+permissions: {}
 
 jobs:
   auto-assign:
@@ -26,7 +29,7 @@ jobs:
       pull-requests: write
     steps:
       - name: "Auto-assign PR"
-        uses: pozil/auto-assign-issue@v2
+        uses: pozil/auto-assign-issue@7bf9d82c77d45976224660b873fc83e60576c5aa # v2
         with:
           assignees: dolphin1999,isaurabhuttam,prernakakkar-google
           numOfAssignee: 1

.github/workflows/header-check.yml

@@ -18,13 +18,18 @@ on:
   pull_request:
     branches: [ main ]
 
+permissions:
+  contents: read
+
 jobs:
   license-check:
     name: 'License Header Check'
     runs-on: ubuntu-latest
     steps:
       - name: 'Checkout Repository'
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        with:
+          persist-credentials: false
 
       - name: Check License Header
         uses: apache/skywalking-eyes/header@61275cc80d0798a405cb070f7d3a8aaf7cf2c2c1 # v0.8.0

.github/workflows/json-lint.yml

@@ -18,12 +18,17 @@ on:
   pull_request:
     branches: [ main ]
 
+permissions:
+  contents: read
+
 jobs:
   json-lint:
     runs-on: ubuntu-latest
     steps:
       - name: Check out code
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        with:
+          persist-credentials: false
 
       - name: Run JSON Lint
-        run: jq . gemini-extension.json
+        run: jq . gemini-extension.json

.github/workflows/markdown-checks.yml

@@ -18,13 +18,18 @@ on:
   pull_request:
     branches: [ main ]
 
+permissions:
+  contents: read
+
 jobs:
   link-check:
     name: Run link check
     runs-on: ubuntu-latest
     steps:
       - name: Check out code
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        with:
+          persist-credentials: false
 
       - name: Link Checker
         uses: lycheeverse/lychee-action@a8c4c7cb88f0c7386610c35eb25108e448569cb0 # v2.7.0

.github/workflows/pr-title-linter.yml

@@ -17,11 +17,14 @@ name: 'Lint PR Title'
 on:
   pull_request:
 
+permissions:
+  pull-requests: read
+
 jobs:
   main:
     name: Validate PR title
     runs-on: ubuntu-latest
     steps:
-      - uses: amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50 # v6
+      - uses: amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50 # v6.1.1
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/presubmit-tests.yml

@@ -25,6 +25,8 @@ jobs:
     steps:
       - name: Check out code
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Install Gemini CLI
         run: npm install @google/gemini-cli

.github/workflows/sync-labels.yaml

@@ -30,6 +30,8 @@ jobs:
       pull-requests: 'write'
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
       - uses: micnncim/action-label-syncer@3abd5ab72fda571e69fffd97bd4e0033dd5f495c # v1.3.0
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.lycheeignore

@@ -1 +1 @@
-https://github.com/gemini-cli-extensions/postgres/compare/
+https://github.com/GoogleCloudPlatform/postgres-plugin/compare/