The actions actions/setup-go@v6, actions/checkout@v5, and softprops/action-gh-release@v2 are not allowed in kubernetes-sigs/krew because all actions must be pinned to a full-length commit SHA.