The actions actions/checkout@v4 and actions/setup-node@master are not allowed in aboutcode-org/scancode-workbench because all actions must be pinned to a full-length commit SHA.