actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 and zgosalvez/github-actions-ensure-sha-pinned-actions@f32435541e24cd6a4700a7f52bb2ec59e80603b1 are not allowed to be used in giantswarm/kyverno-upstream. Actions in this workflow must be: within a repository owned by giantswarm or matching the following: actions/checkout@v3, tibdex/github-app-token@v1.