VLN-1361: remediate unpinned-github-actions

[picatz]

🏕️ This pull request was created by camper, an automated security campaign tool.

Finding

Rule	unpinned-github-actions
Severity	LOW
Repository	temporalio/api-go
Ticket	VLN-1361

Summary

🤠 Deputy pinned dependencies to immutable references.

• Total refs: 15
• Pinned refs: 15

Changed references:

• actions/checkout: v4 -> 34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
• actions/setup-go: v5 -> 40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
• actions/checkout: v4 -> 34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
• arduino/setup-protoc: v3 -> c65c819552d16ad3c9b72d9dfd5ba5237b9c906b # v3.0.0
• actions/setup-go: v2 -> bfdd3570ce990073878bf10f6b2d79082de49492 # v2.2.0
• actions/create-github-app-token: v1 -> d72941d797fd3113feb6b93fd0dec494b13a2547 # v1.12.0
• actions/checkout: v4 -> 34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
• actions/create-github-app-token: v1 -> d72941d797fd3113feb6b93fd0dec494b13a2547 # v1.12.0
• actions/create-github-app-token: v1 -> d72941d797fd3113feb6b93fd0dec494b13a2547 # v1.12.0
• arduino/setup-protoc: v1 -> 149f6c87b92550901b26acd1632e11c3662e381f # v1.3.0
• +5 more

Instructions

• Approve to merge this fix
• Request changes to trigger a new remediation attempt
• /camper rebase — rebase onto the base branch
• /camper close — close this PR without merging
• /camper retry — close and retry with a new fix

[semgrep-managed-scans]

Semgrep found 6 missing-explicit-permissions findings:

• .github/workflows/update-proto.yml
  • L22-85 - Triage
• .github/workflows/publish-release.yml
  • L22-49 - Triage
• .github/workflows/delete-release.yml
  • L22-46 - Triage
• .github/workflows/create-release.yml
  • L30-96 - Triage
• .github/workflows/ci.yml
  • L10-27 - Triage
• .github/workflows/check-sdk-compat.yml
  • L31-85 - Triage

No explicit GITHUB_TOKEN permissions found at the workflow or job level. Add a permissions: block at the workflow root (applies to all jobs) or per job with least privilege (e.g., contents: read and only specific writes like pull-requests: write if needed).