The actions github/codeql-action/init@v4 and github/codeql-action/analyze@v4 are not allowed in DataBiosphere/data-browser because all actions must be from a repository owned by DataBiosphere or match one of the patterns: actions/*, googleapis/release-please-action@v4.