The actions actions/checkout@v4, shivammathur/setup-php@v2, actions/cache@v3, and actions/setup-node@v4 are not allowed in boxwise/dropapp because all actions must be from a repository owned by boxwise and pinned to a full-length commit SHA.