The actions webiny/action-conventional-commits@v1.3.0, erlef/setup-beam@v1, actions/checkout@v4.1.3, actions/checkout@v4, and actions/cache@v4 are not allowed in straw-hat-team/commanded because all actions must be from a repository owned by straw-hat-team, created by GitHub, or match one of the patterns: 1password/load-secrets-action@*, Swatinem/rust-cache@*, autero1/action-terragrunt@*, docker/build-push-action@*, docker/login-action@*, docker/metadata-action@*, dtolnay/rust-toolchain@*, google-github-actions/auth@*, googleapis/release-please-action@*, opentofu/setup-opentofu@*, pnpm/action-setup@*, straw-hat-team/*@*. All actions must also be pinned to a full-length commit SHA.