The actions actions/checkout@v4, actions/setup-python@v5.2.0, astral-sh/setup-uv@v3, codecov/codecov-action@v4, and codecov/test-results-action@v1 are not allowed in vinitkumar/json2xml because all actions must be pinned to a full-length commit SHA.