The actions actions/checkout@v4 and actions/setup-python@v3 are not allowed in python/cpython because all actions must be pinned to a full-length commit SHA.