feat(release): publish to every supported ecosystem from one release dispatch (Maven Central + NuGet + consolidated release.yml)

.gitattributes

@@ -3,3 +3,25 @@
 # golden.test.ts). EOL conversion on checkout (Windows CRLF) breaks the
 # byte-for-byte comparison, so they are checked out exactly as committed.
 crates/socket-patch-core/tests/fixtures/redirect/** -text
+
+# Packagist dist allowlist (fail-closed).
+#
+# Packagist serves dist zips from GitHub codeload archives (git archive),
+# which honor export-ignore. The Composer package manifest must live at the
+# repository root (Packagist only publishes root manifests), so without this
+# block the dist zip would ship the entire repository. The deny-by-default
+# first line export-ignores every top-level entry, then the -export-ignore
+# lines un-ignore exactly the files the Composer package needs — so any
+# future top-level directory stays out of the dist zip automatically.
+#
+# Side effect (deliberate, but easy to miss): export-ignore applies to EVERY
+# git-archive consumer, not just Packagist — GitHub's auto-generated
+# "Source code (zip/tar.gz)" assets on releases and codeload tarballs
+# (`npm install SocketDev/socket-patch#tag`, pip-from-archive-URL, distro
+# packagers) will contain only the files allowlisted below. Anyone needing
+# the full source should clone the repository or use the tagged tree.
+/*             export-ignore
+/composer.json -export-ignore
+/composer      -export-ignore
+/LICENSE       -export-ignore
+/README.md     -export-ignore

.github/workflows/ci.yml

@@ -41,8 +41,10 @@ jobs:
 
   # Lint the out-of-workspace packaging artifacts for the ecosystems whose setup
   # / CLI-distribution we added: the RubyGems CLI launcher gem + the Bundler
-  # plugin gem (Ruby) and the Composer CLI launcher (PHP). Ruby, PHP, and
-  # Composer are all pre-installed on the ubuntu-latest runner.
+  # plugin gem (Ruby), the Composer CLI launcher (PHP), the Maven Central
+  # launcher jar (Java), and the NuGet .NET-tool launcher. Ruby, PHP, Composer,
+  # a Temurin JDK + Maven, and the .NET SDK are all pre-installed on the
+  # ubuntu-latest runner.
   lint-ecosystems:
     runs-on: ubuntu-latest
     steps:
@@ -60,9 +62,23 @@ jobs:
           ruby -c crates/socket-patch-core/src/gem_setup/templates/gemspec.tmpl
 
       - name: PHP — lint the Composer launcher + validate composer.json
+        # composer.json lives at the repo root (Packagist requires the
+        # manifest at the VCS root), so validate runs from there; the
+        # launcher script itself stays under composer/socket-patch/bin.
         run: |
           php -l composer/socket-patch/bin/socket-patch
-          ( cd composer/socket-patch && composer validate --no-check-publish )
+          composer validate --no-check-publish
+
+      - name: Java — build the Maven Central launcher jar
+        # `package` exercises compile + jar + the -sources/-javadoc plugins
+        # Central mandates; -Dgpg.skip because CI has no release signing key.
+        run: mvn --batch-mode --no-transfer-progress -f maven/socket-patch/pom.xml package -Dgpg.skip=true
+
+      - name: .NET — pack the NuGet tool launcher
+        # `pack` (not just build) so the PackAsTool/ToolCommandName metadata
+        # is validated too. Output goes to RUNNER_TEMP to keep the checkout
+        # clean.
+        run: dotnet pack nuget/socket-patch -c Release -o "$RUNNER_TEMP/nupkg"
 
       - name: Shell — shellcheck the curl|sh installer
         # install.sh is the third distribution artifact this job lints; it