Add trap for temp file cleanup and fix Go version

- Add EXIT trap to ensure password file cleanup even on initdb failure
- Update Go version from invalid 1.24.11 to 1.23 in workflows
- Ensure consistent Go version across all CI workflows

Author: moizpgedge

.github/workflows/pr_test_latest.yaml

@@ -114,7 +114,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v5
         with:
-          go-version: '1.24.11'
+          go-version: '1.23'
           cache-dependency-path: tests/go.sum
 
       - name: Pull image

.github/workflows/test_images.yaml

@@ -99,7 +99,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v5
         with:
-          go-version: '1.24.11'
+          go-version: '1.23'
           cache-dependency-path: tests/go.sum
 
       - name: Pull image

docker-entrypoint.sh

@@ -117,6 +117,8 @@ docker_init_database_dir() {
 	# Create a temporary password file to avoid command injection via POSTGRES_INITDB_ARGS
 	local pwfile
 	pwfile="$(mktemp)"
+	# Ensure cleanup on exit (including errors) to prevent password file from being left on disk
+	trap 'rm -f "$pwfile"' EXIT
 	printf '%s\n' "$POSTGRES_PASSWORD" > "$pwfile"
 
 	# Build initdb command arguments safely using an array
@@ -143,8 +145,10 @@ docker_init_database_dir() {
 	# Execute initdb with the safely constructed arguments
 	initdb "${initdb_args[@]}"
 
-	# Clean up temporary password file
+	# Clean up temporary password file (trap will also handle this on exit, but explicit cleanup is good)
 	rm -f "$pwfile"
+	# Remove the trap since we've cleaned up manually
+	trap - EXIT
 
 	# unset/cleanup "nss_wrapper" bits
 	if [[ "${LD_PRELOAD:-}" == */libnss_wrapper.so ]]; then