ci(security): SHA-pin GitHub Actions in publish.yml (SEC-06)

[wisdommen]

This is a uses:-SHA-value-only pin of the three GitHub Actions in .github/workflows/publish.yml — no version bump, no trigger/if:/with:/env:/needs:/step-order changes. Each @v4 ref is replaced by its commit SHA with a trailing # v4 (vX.Y.Z) comment. Part of GSD phase 28 batch-2 (SEC-06 SHA-pin cohort).

Diff (3 lines changed, 3 insertions / 3 deletions — all on uses: lines):

• actions/checkout@v4 → actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 (v4.3.1)
• actions/setup-java@v4 → actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4 (v4.8.0)
• actions/setup-node@v4 → actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 (v4.4.0)

---

UltiLogin C1–C6 Verdict Block (from 28-03 no-release proof artifact)

Module: UltiLogin (SEC-06, Archetype C)

• C1 — Diff is SHA-value-only (asserted invariant). The candidate diff MUST change only the SHA token on the three mapped uses: lines re-confirmed @v4 on origin/master this plan — L22 actions/checkout@v4, L27 actions/setup-java@v4, L94 actions/setup-node@v4 — plus an optional trailing # v4 (vX.Y.Z) comment, pasting the 26-02 §2c pin strings verbatim. It MUST add/remove/modify no on:/trigger, no if:, no with:, no env:, no needs:, and no step ordering or job logic. Pre-state (the three current @v4 lines on origin/master): 22: - uses: actions/checkout@v4 / 27: uses: actions/setup-java@v4 / 94: uses: actions/setup-node@v4. (Re-verified against git diff origin/master in Task 3, gated behind the Task 2 token.)
• C2 — Trigger model (leg a). on: push: branches: [master] (with paths-ignore, L6) + workflow_dispatch (L10). Neither event is produced by the pin edit itself: a SHA-pin commit on a feature branch targeting master via PR does not trigger the push: branches: [master] path until merge, and at merge the existing-version guard (C5) intercepts before any publish step. No pull_request trigger (26-01 §0 — the condition forcing the config-only method; grep -c pull_request on origin/master = 0).
• C3 — Guard (leg b). Single job release-and-publish (L17, permissions: contents: write L19–20). Step check (Check if release exists, L48) runs if gh release view "v${{ steps.version.outputs.VERSION }}" > /dev/null 2>&1; then EXISTS=true ... else EXISTS=false (L53/54/57). Every subsequent publish step is gated if: steps.check.outputs.EXISTS == 'false' (L61, L76, L80, L84, L93, L99, L104).
• C4 — Diff-reachability = unreachable-to-publish (leg c). Because C1 holds, the trigger (C2) and the EXISTS guard (C3/C5) are byte-identical pre/post pin. The set of conditions under which any publish step runs is therefore unchanged. The pin cannot alter pom.xml <version> nor the release state, so it cannot flip EXISTS.
• C5 — Existing-version guard (Archetype C, D-04). Read-only evidence captured 2026-06-11:
  • ${VERSION} = 1.0.0 (from git show origin/master:pom.xml project <version>, L9 — read-only, no Maven build).
  • gh release view "v1.0.0" --repo UltiKits/UltiLogin → exit 0; payload {"createdAt":"2026-02-15T01:52:26Z","isDraft":false,"isPrerelease":false,"name":"v1.0.0","tagName":"v1.0.0"}.
  • EXISTS=true — release v1.0.0 is published (not draft, not prerelease). The EXISTS=true branch short-circuits every publish step unconditionally; a SHA-only pin on a feature branch cannot flip EXISTS.
• C6 — Verdict. PASS — config-only pin, unreachable-to-publish. Master base ref a655e23c9010ef17c81ead1f6569ac49cdd02d96; publish.yml master sha256 36728f8498b903237d1fdb3ee4d84c5e8f0cd6c3e6a3254f0a743d70f0d85998 (pre == post; master fingerprint re-captured this plan on the origin/master base, D-03). Shares the 28-01 seed sha256 (byte-identical publish.yml).
  • Side-effect baseline: release set = v1.0.0 (Latest); remote tag set = 040c552da30f2c1cdef18159e2df571a2c3f74f1 refs/tags/v1.0.0.

---

EXISTS=true evidence (proof-before-edit, D-04)

gh release view v1.0.0 --repo UltiKits/UltiLogin returns a published release (not draft, not prerelease):

{"createdAt":"2026-02-15T01:52:26Z","isDraft":false,"isPrerelease":false,"name":"v1.0.0","publishedAt":"2026-02-15T11:45:23Z","tagName":"v1.0.0"}

• pom <version> = 1.0.0 → guard evaluates gh release view v1.0.0 → exit 0 → EXISTS=true → every publish step short-circuits.
• Live release list at PR time: v1.0.0 (Latest) only.
• Live remote tag set at PR time: refs/tags/v1.0.0 only.

---

Must NOT be merged until the maintainer's per-PR token with proof PASS + CI confirming no release/tag/publish fired.

[coderabbitai]

Warning

Review limit reached

@wisdommen, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 18 seconds. Learn how PR review limits work.

Your organization has run out of usage credits. Purchase more in the billing tab.

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 584985bd-9dd9-4a90-9956-8d41e783220a

📥 Commits

Reviewing files that changed from the base of the PR and between a655e23 and 29288cf.

📒 Files selected for processing (1)

• .github/workflows/publish.yml

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feature/sha-pin-publish-yml

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}