The actions step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594, actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd, step-security/cosign-installer@9610e5af306c47db1756d9e09a0388449e336ab7, step-security/setup-buildx-action@f931205d68723ad9589fd2a7e2ece238bf9de341, step-security/docker-login-action@6aa05fe688caf2c58e784663f01b3415ced503e8, and 2 others are not allowed in TLMSLLC/opentonapi because all actions must be from a repository owned by your enterprise and pinned to a full-length commit SHA.