The actions actions/checkout@v4, actions/setup-node@v4, pnpm/action-setup@v4, and braintrustdata/eval-action@v1 are not allowed in braintrustdata/autoevals because all actions must be pinned to a full-length commit SHA.