The actions actions/checkout@v4, actions/setup-go@v5, and peter-evans/create-pull-request@v5 are not allowed in kubernetes-sigs/provider-aws-test-infra because all actions must be pinned to a full-length commit SHA.