The actions oven-sh/setup-bun@v2, actions/upload-artifact@v4, and endbug/add-and-commit@v9 are not allowed in bazel-contrib/rules_kotlin because all actions must be pinned to a full-length commit SHA.