The actions actions/checkout@v5, actions/setup-node@v6, actions/upload-artifact@v4, and actions/github-script@v8 are not allowed in IntimateMerger/Prebid.js because all actions must be pinned to a full-length commit SHA.