The actions actions/checkout@v4 and actions/setup-dotnet@v4 are not allowed in digipost/digipost-api-client-dotnet because all actions must be pinned to a full-length commit SHA.