The actions actions/checkout@v2 and actions/setup-python@v2 are not allowed in aboutcode-org/vulnerablecode because all actions must be pinned to a full-length commit SHA.