The action actions/upload-artifact@v4 is not allowed in hyperpolymath/refugia because all actions must be from a repository owned by hyperpolymath, created by GitHub, verified in the GitHub Marketplace, or match one of the patterns: dtolnay/rust-toolchain@*, editorconfig-checker/action-editorconfig-checker@*, haskell-actions/setup@*, webfactory/ssh-agent@*. All actions must also be pinned to a full-length commit SHA.