fix(ci): commit the prebuilt Maven extension jar instead of building at release

The release runs behind Socket Firewall, which intercepts the Maven wrapper's
download of Maven (and the extension's plugin dependencies) and fails the build,
so the jar cannot be compiled during the publish workflow. Commit the shaded jar
and drop the build:maven-extension step from provenance.yml. Rebuild the jar
locally with build-jar.sh after changing the extension source; the dist build
copies the committed jar and still fails closed if it is missing.

Author: jfblaa

.config/rollup.dist.config.mjs

@@ -82,9 +82,8 @@ async function copyInitGradle() {
 
 // Copy the JVM build-tool resolution assets (Gradle init script, sbt plugin,
 // Maven extension jar) into dist/manifest-scripts, where run.mts resolves them
-// at runtime. The Maven jar is compiled by maven-extension/build-jar.sh (run in
-// CI / local dev) and is absent from a fresh checkout — copy it only if present;
-// run.mts surfaces a build hint when it's missing.
+// at runtime. The Maven jar is committed (rebuilt by maven-extension/build-jar.sh
+// after source changes); the published build fails closed if it is missing.
 async function copyManifestScripts() {
   const srcDir = path.join(constants.srcPath, 'commands/manifest/scripts')
   const destDir = path.join(constants.distPath, 'manifest-scripts')

.github/workflows/provenance.yml

@@ -204,18 +204,6 @@ jobs:
       - name: Install dependencies
         run: pnpm install --loglevel error
 
-      # Compile the Maven manifest extension jar so the dist build bundles it
-      # into dist/manifest-scripts (the jar is never committed; it ships only in
-      # the published package). The org action allowlist forbids actions/setup-java,
-      # so use a JDK pre-installed on the runner image (JAVA_HOME_17_X64), falling
-      # back to the runner's default `java`. build-jar.sh uses the Maven wrapper.
-      - name: Build Maven manifest extension jar
-        run: |
-          if [ -n "${JAVA_HOME_17_X64:-}" ]; then
-            export JAVA_HOME="$JAVA_HOME_17_X64"
-          fi
-          pnpm run build:maven-extension
-
       - run: INLINED_SOCKET_CLI_PUBLISHED_BUILD=1 pnpm run build:dist
       - name: Publish socket
         id: publish_socket

src/commands/manifest/scripts/maven-extension/.gitignore

@@ -1,3 +1,4 @@
-# Build artifacts — the jar is compiled from source (build-jar.sh), never committed.
+# Maven build output. The shaded jar (coana-maven-extension.jar) is committed so
+# the published package ships it without a build-time network fetch; rebuild it
+# with build-jar.sh after changing the extension source.
 target/
-coana-maven-extension.jar

src/commands/manifest/scripts/maven-extension/build-jar.sh

@@ -1,7 +1,8 @@
 #!/usr/bin/env bash
 # Compile the Coana Maven core extension to a self-contained jar and place it at the path the TS
-# runner resolves: manifest-scripts/maven-extension/coana-maven-extension.jar. Run by the npm-package
-# build and the manifest-maven CI job. Uses the bundled Maven wrapper, so it needs only a JDK.
+# runner resolves: manifest-scripts/maven-extension/coana-maven-extension.jar. The jar is committed,
+# so run this to refresh it after changing the extension source. Uses the bundled Maven wrapper, so
+# it needs only a JDK (and network access to fetch Maven and the plugin dependencies).
 set -euo pipefail
 
 here="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"