VLN-1354: remediate unpinned-github-actions

[picatz]

🏕️ This pull request was created by camper, an automated security campaign tool.

Finding

Rule	unpinned-github-actions
Severity	HIGH
Repository	temporalio/cli
Ticket	VLN-1354

Summary

• .github/workflows/trigger-docs.yml: Pinned actions/create-github-app-token from @v2 to a full 40-character commit SHA with exact semver comment # v2.2.2.
• .github/workflows/build-and-publish-docker.yml: Pinned actions/checkout, actions/github-script, docker/setup-qemu-action, docker/setup-buildx-action, and docker/login-action to full 40-character commit SHAs with exact semver comments.
• .github/workflows/release.yml: Pinned actions/checkout, actions/setup-go, and goreleaser/goreleaser-action to full 40-character commit SHAs with exact semver comments.
• .github/workflows/ci.yaml: Pinned both actions/checkout refs, both actions/setup-go refs, and actions/upload-artifact to full 40-character commit SHAs with exact semver comments.
• .github/workflows/govulncheck.yml: Pinned actions/checkout and actions/setup-go to full 40-character commit SHAs with exact semver comments; left temporalio/public-actions/... unchanged per exception.

Instructions

• Approve to merge this fix
• Request changes to trigger a new remediation attempt
• /camper rebase — rebase onto the base branch
• /camper close — close this PR without merging
• /camper retry — close and retry with a new fix

[chaptersix]

@picatz does this play nice with dependabot?

[picatz]

Dependabot knows how to bump the SHAs, and it updates the comment too:

So it'll play nicely with our cooldown config from #1024:

cli/.github/dependabot.yml

Lines 10 to 15 in c4061c4

	- package-ecosystem: github-actions
	directory: "/"
	schedule:
	interval: weekly
	cooldown:
	default-days: 14

[chaptersix]

Dependabot knows how to bump the SHAs, and it updates the comment too:

So it'll play nicely with our cooldown config from #1024:

cli/.github/dependabot.yml

Lines 10 to 15 in c4061c4

	- package-ecosystem: github-actions
	directory: "/"
	schedule:
	interval: weekly
	cooldown:
	default-days: 14

what's the pal for enforcing this going forward? Is there a CI check or can dependabot revert it back to sha?

[chaptersix]

it's be great if this PR could go ahead and bump action versions as well. It'd resolve a good but of the dependabot PRs and reviews are a bit slow in this repo right now.

[picatz]

what's the pal for enforcing this going forward? Is there a CI check or can dependabot revert it back to sha?

We plan to have a SAST check, likely as a required workflow we'll apply to repos; we have a few options we're exploring, but you will see alerts happen in PRs as feedback in the future.

Dependabot will not be able to revert it back to SHA.

it's be great if this PR could go ahead and bump action versions as well. It'd resolve a good but of the dependabot PRs and reviews are a bit slow in this repo right now.

The campaign scope aims to just pin to whatever users are using. But, if you'd like, I can bump the versions too. It just carries its own risk of not working, or causing different churn / issues than pinning to what's working.

[chaptersix]

Using this for the commit message:

VLN-1354: pin and bump GitHub Actions to latest versions

Pin all GitHub Actions to full 40-character commit SHAs and bump to
latest versions across all workflows:

- actions/checkout v4.3.1 -> v6.0.2
- actions/setup-go -> v6.4.0
- actions/upload-artifact (already pinned, kept current)
- actions/create-github-app-token v2.2.2 -> v3.1.1 (#1037)
- actions/github-script v8.0.0 -> v9.0.0 (#1036)
- docker/setup-qemu-action v3.2.0 -> v4.1.0
- docker/setup-buildx-action v3.10.0 -> v4.1.0 (#1035)
- docker/login-action v3.5.0 -> v4.2.0
- goreleaser/goreleaser-action v6.4.0 -> v7.2.1 (#1039)

Resolves open Dependabot PRs #1035, #1036, #1037, #1038, #1039.
Left temporalio/public-actions refs unchanged per exception policy.

[picatz]

Sounds good to me, thank you! 😄