fix: normalize postgres UUIDs to strings

.github/workflows/cloudflare_sync.yaml

@@ -36,7 +36,7 @@ jobs:
       github.event_name == 'workflow_dispatch' ||
       (github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.head_repository.full_name == github.repository)
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           ref: 'cloudflare-pages'
           persist-credentials: false

.github/workflows/conformance.yml

@@ -52,7 +52,7 @@ jobs:
             }
 
       - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           ref: ${{ github.event.pull_request.head.sha }}
           repository: ${{ github.event.pull_request.head.repo.full_name }}

.github/workflows/deploy_dev_docs_to_cf.yaml

@@ -41,7 +41,7 @@ jobs:
       group: cf-docs-update
       cancel-in-progress: true
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
           submodules: recursive
@@ -54,7 +54,7 @@ jobs:
           extended: true
 
       - name: Setup Node
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: "22"
 

.github/workflows/deploy_previous_version_docs_to_cf.yaml

@@ -30,15 +30,15 @@ jobs:
 
     steps:
       - name: Checkout main branch (for latest templates and theme)
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           ref: 'main'
           submodules: 'recursive'
           fetch-depth: 0
           persist-credentials: false
 
       - name: Checkout old content from tag into a temporary directory
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           ref: ${{ github.event.inputs.version_tag }}
           path: 'old_version_source'
@@ -60,7 +60,7 @@ jobs:
           extended: true
 
       - name: Setup Node
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: "22"
 

.github/workflows/deploy_versioned_docs_to_cf.yaml

@@ -30,7 +30,7 @@ jobs:
       cancel-in-progress: false
     steps:
       - name: Checkout Code at Tag
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           ref: ${{ github.event.release.tag_name }}
           persist-credentials: false
@@ -50,7 +50,7 @@ jobs:
       - name: Setup Node
         # zizmor flags setup-node for cache-poisoning on releases, but since we don't pass `cache: npm`, no caching occurs. Safe to ignore.
         # zizmor: ignore[cache-poisoning]
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: "22"
 

.github/workflows/docs_lint.yaml

@@ -32,7 +32,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
 

.github/workflows/docs_preview_build_cf.yaml

@@ -40,7 +40,7 @@ jobs:
       run:
         working-directory: .hugo
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           ref: ${{ env.HEAD_SHA }}
           fetch-depth: 0
@@ -53,7 +53,7 @@ jobs:
           extended: true
 
       - name: Setup Node
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: "22"
           cache: 'npm'

.github/workflows/docs_preview_deploy_cf.yaml

@@ -46,7 +46,7 @@ jobs:
       cancel-in-progress: true
     steps:
       - name: Checkout base repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
 

.github/workflows/link_checker.yaml

@@ -23,7 +23,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           ref: ${{ github.event.pull_request.head.sha }}
           fetch-depth: 0
@@ -64,7 +64,7 @@ jobs:
       - name: Link Checker
         id: lychee-check       
         if: steps.changed-files.outputs.HAS_CHANGES == 'true'
-        uses: lycheeverse/lychee-action@8646ba30535128ac92d33dfc9133794bfdd9b411 # v2
+        uses: lycheeverse/lychee-action@8646ba30535128ac92d33dfc9133794bfdd9b411 # v2.8.0
         continue-on-error: true 
         with:
           args: >

.github/workflows/link_checker_report.yaml

@@ -23,14 +23,14 @@ jobs:
       issues: write
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
           persist-credentials: false
 
       - name: Link Checker
         id: lychee-check
-        uses: lycheeverse/lychee-action@8646ba30535128ac92d33dfc9133794bfdd9b411 # v2
+        uses: lycheeverse/lychee-action@8646ba30535128ac92d33dfc9133794bfdd9b411 # v2.8.0
         continue-on-error: true
         with:
           args: >

.github/workflows/nightly_tier_report.yml

@@ -28,7 +28,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
 
@@ -44,7 +44,7 @@ jobs:
           sleep 5 # Give the server a moment to bind to port 5000
 
       - name: Setup Node
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: "22"
 

.github/workflows/publish-mcp.yml

@@ -32,7 +32,7 @@ jobs:
         run: sleep 1200
 
       - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
 

internal/sources/alloydbpg/alloydb_pg.go

@@ -121,7 +121,8 @@ func (s *Source) RunSQL(ctx context.Context, statement string, params []any) (an
 		}
 		row := orderedmap.Row{}
 		for i, f := range fields {
-			row.Add(f.Name, v[i])
+			val := sources.NormalizeValue(v[i], f.DataTypeOID)
+			row.Add(f.Name, val)
 		}
 		out = append(out, row)
 	}

internal/sources/cloudsqlpg/cloud_sql_pg.go

@@ -127,7 +127,8 @@ func (s *Source) RunSQL(ctx context.Context, statement string, params []any) (an
 		}
 		row := orderedmap.Row{}
 		for i, f := range fields {
-			row.Add(f.Name, values[i])
+			val := sources.NormalizeValue(values[i], f.DataTypeOID)
+			row.Add(f.Name, val)
 		}
 		out = append(out, row)
 	}

internal/sources/postgres/postgres.go

@@ -125,7 +125,8 @@ func (s *Source) RunSQL(ctx context.Context, statement string, params []any) (an
 		}
 		row := orderedmap.Row{}
 		for i, f := range fields {
-			row.Add(f.Name, values[i])
+			val := sources.NormalizeValue(values[i], f.DataTypeOID)
+			row.Add(f.Name, val)
 		}
 		out = append(out, row)
 	}

internal/sources/util.go

@@ -23,9 +23,42 @@ import (
 	"strings"
 
 	"cloud.google.com/go/cloudsqlconn"
+	"github.com/google/uuid"
 	"golang.org/x/oauth2/google"
 )
 
+// NormalizeValue converts specific database types to friendly representations (e.g. UUID to string).
+func NormalizeValue(val any, oid uint32) any {
+	// 2950 is the standard OID for UUID in PostgreSQL
+	if oid == 2950 {
+		if b, ok := val.([16]byte); ok {
+			return uuid.UUID(b).String()
+		}
+	}
+	// 2951 is the standard OID for _uuid (UUID array) in PostgreSQL
+	if oid == 2951 {
+		if arr, ok := val.([][16]byte); ok {
+			strs := make([]string, len(arr))
+			for i, b := range arr {
+				strs[i] = uuid.UUID(b).String()
+			}
+			return strs
+		}
+		if arr, ok := val.([]any); ok {
+			strs := make([]any, len(arr))
+			for i, item := range arr {
+				if b, ok := item.([16]byte); ok {
+					strs[i] = uuid.UUID(b).String()
+				} else {
+					strs[i] = item
+				}
+			}
+			return strs
+		}
+	}
+	return val
+}
+
 // GetCloudSQLDialOpts retrieve dial options with the right ip type and user agent for cloud sql
 // databases.
 func GetCloudSQLOpts(ipType, userAgent string, useIAM bool) ([]cloudsqlconn.Option, error) {

internal/sources/util_test.go

@@ -0,0 +1,56 @@
+// Copyright 2026 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package sources
+
+import (
+	"testing"
+)
+
+func TestNormalizeValue(t *testing.T) {
+	// Test case 1: UUID OID (2950) with [16]byte
+	uuidBytes := [16]byte{1, 158, 103, 138, 45, 22, 120, 229, 146, 32, 191, 118, 245, 114, 247, 50}
+	expectedUUIDStr := "019e678a-2d16-78e5-9220-bf76f572f732"
+
+	result := NormalizeValue(uuidBytes, 2950)
+	if str, ok := result.(string); !ok || str != expectedUUIDStr {
+		t.Errorf("Expected UUID string %s, got %v", expectedUUIDStr, result)
+	}
+
+	// Test case 2: UUID OID (2950) with other type
+	result = NormalizeValue("not-bytes", 2950)
+	if str, ok := result.(string); !ok || str != "not-bytes" {
+		t.Errorf("Expected original string 'not-bytes', got %v", result)
+	}
+
+	// Test case 3: Other OID
+	result = NormalizeValue(uuidBytes, 1000)
+	if bytes, ok := result.([16]byte); !ok || bytes != uuidBytes {
+		t.Errorf("Expected original [16]byte array, got %v", result)
+	}
+
+	// Test case 4: UUID Array OID (2951) with [][16]byte
+	uuidArray := [][16]byte{uuidBytes}
+	result = NormalizeValue(uuidArray, 2951)
+	if arr, ok := result.([]string); !ok || len(arr) != 1 || arr[0] != expectedUUIDStr {
+		t.Errorf("Expected []string with %s, got %v", expectedUUIDStr, result)
+	}
+
+	// Test case 5: UUID Array OID (2951) with []any
+	uuidAnyArray := []any{uuidBytes, "not-a-uuid"}
+	result = NormalizeValue(uuidAnyArray, 2951)
+	if arr, ok := result.([]any); !ok || len(arr) != 2 || arr[0] != expectedUUIDStr || arr[1] != "not-a-uuid" {
+		t.Errorf("Expected []any with normalized UUID, got %v", result)
+	}
+}

internal/sources/yugabytedb/yugabytedb.go

@@ -115,7 +115,8 @@ func (s *Source) RunSQL(ctx context.Context, statement string, params []any) (an
 		}
 		vMap := make(map[string]any)
 		for i, f := range fields {
-			vMap[f.Name] = v[i]
+			val := sources.NormalizeValue(v[i], f.DataTypeOID)
+			vMap[f.Name] = val
 		}
 		out = append(out, vMap)
 	}