The actions actions/checkout@v4, actions/setup-go@v5, apple-actions/import-codesign-certs@v1, and actions/upload-artifact@v4 are not allowed in Checkmarx/ast-cli because all actions must be pinned to a full-length commit SHA.