VLN-1461: remediate unpinned-github-actions

[picatz]

🏕️ This pull request was created by camper, an automated security campaign tool.

Finding

Rule	unpinned-github-actions
Severity	MEDIUM
Repository	temporalio/api
Ticket	VLN-1461

Summary

🤠 Deputy pinned dependencies to immutable references.

• Total refs: 13
• Pinned refs: 9
• Skipped refs: 4

Changed references:

• arduino/setup-protoc: v2 -> a8b67ba40b37d35169e222f3bb352603327985b6 # v2.1.0
• dcarbone/install-jq-action: v2 -> 8867ddb4788346d7c22b72ea2e2ffe4d514c7bcb # v2.1.0
• actions/checkout: v4 -> 34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
• actions/setup-go: v4 -> 7b8cf10d4e4a01d4992d18a89f4d7dc5a3e6d6f4 # v4.3.0
• actions/create-github-app-token: v1 -> d72941d797fd3113feb6b93fd0dec494b13a2547 # v1.12.0
• actions/checkout: v4 -> 34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
• actions/checkout: v4 -> 34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
• bufbuild/buf-action: v1 -> fd21066df7214747548607aaa45548ba2b9bc1ff # v1.4.0
• actions/create-github-app-token: v1 -> d72941d797fd3113feb6b93fd0dec494b13a2547 # v1.12.0

Instructions

• Approve to merge this fix
• Request changes to trigger a new remediation attempt
• /camper rebase — rebase onto the base branch
• /camper close — close this PR without merging
• /camper retry — close and retry with a new fix

[semgrep-managed-scans]

Semgrep found 3 missing-explicit-permissions findings:

• .github/workflows/trigger-api-go-update.yml
  • L16-63 - Triage
• .github/workflows/create-release.yml
  • L30-89 - Triage
  • L99-131 - Triage

No explicit GITHUB_TOKEN permissions found at the workflow or job level. Add a permissions: block at the workflow root (applies to all jobs) or per job with least privilege (e.g., contents: read and only specific writes like pull-requests: write if needed).