The actions actions/checkout@v4 and github/codeql-action/upload-sarif@v3 are not allowed in maxmilton/microdoc because all actions must be from a repository owned by maxmilton, created by GitHub, or match one of the patterns: actions/* github/codeql-action/*, crate-ci/typos@*, oven-sh/setup-bun@*, qltysh/qlty-action/coverage@*. All actions must also be pinned to a full-length commit SHA.