actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 and zgosalvez/github-actions-ensure-sha-pinned-actions@19ebcb0babbd282ae1822a0b9c28f3f1f25cea45 are not allowed to be used in giantswarm/kyverno-upstream. Actions in this workflow must be: within a repository owned by giantswarm or matching the following: actions/checkout@v3, tibdex/github-app-token@v1.