sigstore/cosign-installer@dc72c7d5c4d10cd6bcb8cf6e3fd625a9e5e537da, docker/setup-qemu-action@v3, docker/setup-buildx-action@v3, docker/login-action@v3, actions/[email protected], and 6 other actions are not allowed to be used in giantswarm/trivy-upstream. Actions in this workflow must be: within a repository owned by giantswarm or matching the following: actions/checkout@v3, actions/create-github-app-token@v1.