ci: SHA-pin publish.yml GitHub Actions (config-only, no version bump)

[wisdommen]

Summary

Pins the 3 GitHub Actions in .github/workflows/publish.yml (actions/checkout, actions/setup-java, actions/setup-node) to immutable commit SHAs. This is a value-only change — the @v4 behavior is preserved, there is no @v4→@v5 version bump. Config-only pin (SEC-06), provably unreachable-to-publish.

Ref-as-written	Pinned SHA	Comment
actions/checkout@v4	34e114876b0b11c390a56381ad16ebd13914f8d5	# v4 (v4.3.1)
actions/setup-java@v4	c1e323688fd81a25caa38c78aa6df2d33d3e20d9	# v4 (v4.8.0)
actions/setup-node@v4	49933ea5288caeca8642d1e84afbd3f7d6820020	# v4 (v4.4.0)

Changed files

• .github/workflows/publish.yml — 3 lines (3 insertions, 3 deletions), uses-line SHA tokens only.

C1 diff verdict

git diff origin/master -- .github/workflows/publish.yml = exactly 3 uses-line SHA changes only (L22 checkout, L27 setup-java, L94 setup-node). No on:/trigger, no if:, no with:, no env:, no needs:, no step/job logic touched.

EXISTS=true evidence

gh release view v1.0.0 --repo UltiKits/UltiBackup → exit 0, release v1.0.0 found (published, not draft, not prerelease) → EXISTS=true.

Side effects

This PR does NOT merge and does NOT trigger publish. publish.yml fires only on push: branches: [master] + workflow_dispatch, and every publish step is gated if: steps.check.outputs.EXISTS == 'false'. With EXISTS=true (release v1.0.0 already published), all publish steps short-circuit. Opening a PR triggers no publish.

---

No-Release Proof — UltiBackup (SEC-06, Archetype C) — C1–C6 PASS

(D-05 double-key — copied verbatim from 28-02-no-release-proof-verdicts.md)

• C1 — Diff is SHA-value-only (asserted invariant). The candidate diff MUST change only the SHA token on the three mapped uses: lines re-confirmed @v4 on origin/master this plan — L22 actions/checkout@v4, L27 actions/setup-java@v4, L94 actions/setup-node@v4 — plus an optional trailing # v4 (vX.Y.Z) comment, pasting the 26-02 §2c pin strings verbatim. It MUST add/remove/modify no on:/trigger, no if:, no with:, no env:, no needs:, and no step ordering or job logic. Pre-state (the three current @v4 lines on origin/master): 22: - uses: actions/checkout@v4 / 27: uses: actions/setup-java@v4 / 94: uses: actions/setup-node@v4. (Re-verified against git diff origin/master in Task 3, gated behind the Task 2 token.)
• C2 — Trigger model (leg a). on: push: branches: [master] (with paths-ignore for **.md, .gitignore, LICENSE) + workflow_dispatch (optional version input). Neither event is produced by the pin edit itself: a SHA-pin commit on a feature branch targeting master via PR does not trigger the push: branches: [master] path until merge, and at merge the existing-version guard (C5) intercepts before any publish step. No pull_request trigger (26-01 §0 — the condition forcing the config-only method).
• C3 — Guard (leg b). Single job release-and-publish (permissions: contents: write). Step check (Check if release exists, L48) runs if gh release view "v${{ steps.version.outputs.VERSION }}" > /dev/null 2>&1; then EXISTS=true ... else EXISTS=false (L53–57). Every subsequent publish step is gated if: steps.check.outputs.EXISTS == 'false' (L61, L76, L80, L84, L93, L99, L104).
• C4 — Diff-reachability = unreachable-to-publish (leg c). Because C1 holds, the trigger (C2) and the EXISTS guard (C3/C5) are byte-identical pre/post pin. The set of conditions under which any publish step runs is therefore unchanged. The pin cannot alter pom.xml <version> nor the release state, so it cannot flip EXISTS.
• C5 — Existing-version guard (Archetype C, D-04). Read-only evidence captured 2026-06-11:
  • ${VERSION} = 1.0.0 (from git show origin/master:pom.xml project <version>, L9 — read-only, no Maven build).
  • gh release view "v1.0.0" --repo UltiKits/UltiBackup → exit 0; payload {"createdAt":"2026-02-15T01:52:27Z","isDraft":false,"isPrerelease":false,"name":"v1.0.0","tagName":"v1.0.0"}.
  • EXISTS=true — release v1.0.0 is published (not draft, not prerelease). The EXISTS=true branch short-circuits every publish step unconditionally; a SHA-only pin on a feature branch cannot flip EXISTS.
• C6 — Verdict. PASS — config-only pin, unreachable-to-publish. Master base ref c54269116c7258dd840e71aa80b533e3928f8809; publish.yml master sha256 36728f8498b903237d1fdb3ee4d84c5e8f0cd6c3e6a3254f0a743d70f0d85998 (pre == post; master fingerprint re-captured this plan on the origin/master base, D-03). Shares the 28-01 seed sha256 (byte-identical publish.yml).

[coderabbitai]

Warning

Review limit reached

@wisdommen, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 36 minutes and 46 seconds. Learn how PR review limits work.

Your organization has run out of usage credits. Purchase more in the billing tab.

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: f7cdad2c-179e-4e42-b715-eb16cba540ae

📥 Commits

Reviewing files that changed from the base of the PR and between c542691 and d6a06db.

📒 Files selected for processing (1)

• .github/workflows/publish.yml

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feature/sha-pin-publish-yml

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}