The actions actions/checkout@v6 and github/codeql-action/init@v4 are not allowed in IntimateMerger/Prebid.js because all actions must be pinned to a full-length commit SHA.