The actions actions/checkout@v4 and actions/setup-go@v5 are not allowed in kubernetes-sigs/kube-api-linter because all actions must be pinned to a full-length commit SHA.