The actions golangci/golangci-lint-action@v8, aquasecurity/trivy-action@master, actions/checkout@v6, actions/setup-go@v6, github/codeql-action/upload-sarif@v4, and 3 others are not allowed in bedag/storagegrid-operator because all actions must be from a repository owned by bedag, created by GitHub, or match the pattern: docker/*. All actions must also be pinned to a full-length commit SHA and not match any of the patterns: checkmarx/ast-github-action@*, checkmarx/kics-github-action@*.