The actions actions/checkout@v4 and actions/cache@v4 are not allowed in agentclientprotocol/python-sdk because all actions must be pinned to a full-length commit SHA.