VLN-1357: remediate unpinned-github-actions

[picatz]

🏕️ This pull request was created by camper, an automated security campaign tool.

Finding

Rule	unpinned-github-actions
Severity	MEDIUM
Repository	temporalio/ui-server
Ticket	VLN-1357

Summary

🤠 Deputy pinned dependencies to immutable references.

• Total refs: 64
• Pinned refs: 64

Changed references:

• docker/setup-qemu-action: v2 -> 2b82ce82d56a2a04d2637cd93a637ae1b359c0a7 # v2.2.0
• docker/setup-buildx-action: v2 -> 885d1462b80bc1c1c7f0b00334ad271f09369c55 # v2.10.0
• docker/login-action: v3 -> c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
• docker/build-push-action: v4 -> 0a97817b6ade9f46837855d676c4cca3a2471fc9 # v4.2.1
• docker/metadata-action: v4 -> 818d4b7b91585d195f67373fd9cb0332e31a7175 # v4.6.0
• actions/checkout: v4 -> 34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
• actions/checkout: v4 -> 34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
• actions/setup-node: v4 -> 49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
• docker/setup-buildx-action: v2 -> 885d1462b80bc1c1c7f0b00334ad271f09369c55 # v2.10.0
• docker/build-push-action: v4 -> 0a97817b6ade9f46837855d676c4cca3a2471fc9 # v4.2.1
• +54 more

Instructions

• Approve to merge this fix
• Request changes to trigger a new remediation attempt
• /camper rebase — rebase onto the base branch
• /camper close — close this PR without merging
• /camper retry — close and retry with a new fix

[github-actions]

Opengrep — new findings

Severity	Location	Rule	Message
ERROR	.github/workflows/test.yml:11	security.gha.missing-explicit-permissions-temporal	No explicit GITHUB_TOKEN permissions found at the workflow or job level. Add a permissions: block at the workflow root (applies to all jobs) or per job with least privilege (e.g., contents: read and only specific writes like pull-requests: write if needed).

---

Suppress findings

Add a noopengrep comment on the line before the finding:

# noopengrep: <rule-id>

[semgrep-managed-scans]

Semgrep found 1 missing-explicit-permissions finding:

• .github/workflows/test.yml
  • L11-26 - Triage

No explicit GITHUB_TOKEN permissions found at the workflow or job level. Add a permissions: block at the workflow root (applies to all jobs) or per job with least privilege (e.g., contents: read and only specific writes like pull-requests: write if needed).

[picatz]

This PR has had no activity for 7 days and may need attention.

Actions you can take:

• Review and approve if the changes look good
• Close if this fix is no longer needed
• Comment /camper rebase to rebase onto the latest base branch
• Comment /camper retry to regenerate the fix

[picatz]

This PR has had no activity for 7 days and may need attention.

Actions you can take:

• Review and approve if the changes look good
• Close if this fix is no longer needed
• Comment /camper rebase to rebase onto the latest base branch
• Comment /camper retry to regenerate the fix

[picatz]

This PR has had no activity for 9 days and may need attention.

Actions you can take:

• Review and approve if the changes look good
• Close if this fix is no longer needed
• Comment /camper rebase to rebase onto the latest base branch
• Comment /camper retry to regenerate the fix

[picatz]

This PR has had no activity for 7 days and may need attention.

Actions you can take:

• Review and approve if the changes look good
• Close if this fix is no longer needed
• Comment /camper rebase to rebase onto the latest base branch
• Comment /camper retry to regenerate the fix

[picatz]

This PR has had no activity for 9 days and may need attention.

Actions you can take:

• Review and approve if the changes look good
• Close if this fix is no longer needed
• Comment /camper rebase to rebase onto the latest base branch
• Comment /camper retry to regenerate the fix