The actions arduino/setup-protoc@v2, actions/setup-go@v6, magefile/mage-action@v3, pnpm/action-setup@v4, actions/setup-node@v6, and 1 other are not allowed in livekit/protocol because all actions must be pinned to a full-length commit SHA.