actions/checkout@1d96c772d19495a3b5c517cd2bc0cb401ea0529f and sonatype-nexus-community/nancy-github-action@726e338312e68ecdd4b4195765f174d3b3ce1533 are not allowed to be used in giantswarm/kyverno-upstream. Actions in this workflow must be: within a repository owned by giantswarm or matching the following: actions/checkout@v3, tibdex/github-app-token@v1.