The actions biomejs/setup-biome@v2 and actions/checkout@v5 are not allowed in PostHog/Array because all actions must be from a repository owned by your enterprise, created by GitHub, verified in the GitHub Marketplace, or match one of the patterns: PostHog/*, actions/*, and maheshrayas/action-pr-comment-delete@*, astral-sh/setup-uv@*, aws-actions/*, borchero/terraform-plan-comment@*, datadrivers/terragrunt-action@*, docker/*, github/*, hashicorp/*, n1hility/cancel-previous-runs@*, posthog/*, posthog/shared-actions/vpn-connection@main, tailscale/*, teunmooij/yaml@*. All actions must also be pinned to a full-length commit SHA.