sigstore/[email protected] is not allowed to be used in RedHatProductSecurity/trestle-bot. Actions in this workflow must be: within a repository owned by RedHatProductSecurity, created by GitHub, or matching the following: oxsecurity/megalinter@v7, docker/setup-qemu-action@v3, docker/setup-buildx-action@v3, docker/login-action@v3, docker/build-push-action@v5, sonarsource/sonarcloud-github-action@*, sonarsource/sonarqube-quality-gate-action@*, aquasecurity/trivy-action@*.