Summary

Pins the 3 GitHub Actions in .github/workflows/publish.yml (actions/checkout, actions/setup-java, actions/setup-node) to immutable commit SHAs. This is a value-only change — the @v4 behavior is preserved, there is no @v4→@v5 version bump. Config-only pin (SEC-06), provably unreachable-to-publish.

Changed files

• .github/workflows/publish.yml — 3 lines (3 insertions, 3 deletions), uses-line SHA tokens only.

C1 diff verdict

git diff origin/master -- .github/workflows/publish.yml = exactly 3 uses-line SHA changes only (L22 checkout, L27 setup-java, L94 setup-node). No on:/trigger, no if:, no with:, no env:, no needs:, no step/job logic touched.

EXISTS=true evidence

gh release view v1.0.0 --repo UltiKits/UltiBackup → exit 0, release v1.0.0 found (published, not draft, not prerelease) → EXISTS=true.

Side effects

This PR does NOT merge and does NOT trigger publish. publish.yml fires only on push: branches: [master] + workflow_dispatch, and every publish step is gated if: steps.check.outputs.EXISTS == 'false'. With EXISTS=true (release v1.0.0 already published), all publish steps short-circuit. Opening a PR triggers no publish.

No-Release Proof — UltiBackup (SEC-06, Archetype C) — C1–C6 PASS

(D-05 double-key — copied verbatim from 28-02-no-release-proof-verdicts.md)

• C1 — Diff is SHA-value-only (asserted invariant). The candidate diff MUST change only the SHA token on the three mapped uses: lines re-confirmed @v4 on origin/master this plan — L22 actions/checkout@v4, L27 actions/setup-java@v4, L94 actions/setup-node@v4 — plus an optional trailing # v4 (vX.Y.Z) comment, pasting the 26-02 §2c pin strings verbatim. It MUST add/remove/modify no on:/trigger, no if:, no with:, no env:, no needs:, and no step ordering or job logic. Pre-state (the three current @v4 lines on origin/master): 22: - uses: actions/checkout@v4 / 27: uses: actions/setup-java@v4 / 94: uses: actions/setup-node@v4. (Re-verified against git diff origin/master in Task 3, gated behind the Task 2 token.)
• C2 — Trigger model (leg a). on: push: branches: [master] (with paths-ignore for **.md, .gitignore, LICENSE) + workflow_dispatch (optional version input). Neither event is produced by the pin edit itself: a SHA-pin commit on a feature branch targeting master via PR does not trigger the push: branches: [master] path until merge, and at merge the existing-version guard (C5) intercepts before any publish step. No pull_request trigger (26-01 §0 — the condition forcing the config-only method).
• C3 — Guard (leg b). Single job release-and-publish (permissions: contents: write). Step check (Check if release exists, L48) runs if gh release view "v${{ steps.version.outputs.VERSION }}" > /dev/null 2>&1; then EXISTS=true ... else EXISTS=false (L53–57). Every subsequent publish step is gated if: steps.check.outputs.EXISTS == 'false' (L61, L76, L80, L84, L93, L99, L104).
• C4 — Diff-reachability = unreachable-to-publish (leg c). Because C1 holds, the trigger (C2) and the EXISTS guard (C3/C5) are byte-identical pre/post pin. The set of conditions under which any publish step runs is therefore unchanged. The pin cannot alter pom.xml <version> nor the release state, so it cannot flip EXISTS.
• C5 — Existing-version guard (Archetype C, D-04). Read-only evidence captured 2026-06-11:
  • ${VERSION} = 1.0.0 (from git show origin/master:pom.xml project <version>, L9 — read-only, no Maven build).
  • gh release view "v1.0.0" --repo UltiKits/UltiBackup → exit 0; payload {"createdAt":"2026-02-15T01:52:27Z","isDraft":false,"isPrerelease":false,"name":"v1.0.0","tagName":"v1.0.0"}.
  • EXISTS=true — release v1.0.0 is published (not draft, not prerelease). The EXISTS=true branch short-circuits every publish step unconditionally; a SHA-only pin on a feature branch cannot flip EXISTS.
• C6 — Verdict. PASS — config-only pin, unreachable-to-publish. Master base ref c54269116c7258dd840e71aa80b533e3928f8809; publish.yml master sha256 36728f8498b903237d1fdb3ee4d84c5e8f0cd6c3e6a3254f0a743d70f0d85998 (pre == post; master fingerprint re-captured this plan on the origin/master base, D-03). Shares the 28-01 seed sha256 (byte-identical publish.yml).