fix(ci): build the Maven extension jar outside the Socket Firewall shims (#1390)

* fix(ci): build the Maven extension jar outside the Socket Firewall shims

The release build failed because `pnpm run build:maven-extension` runs the whole
build subtree (pnpm -> bash -> mvnw -> wget) under Socket Firewall, which shims
the package managers it wraps. sfw then intercepts the Maven wrapper's download
of Maven from Maven Central and fails on that non-package fetch.

Invoke build-jar.sh directly instead. bash/mvnw/wget aren't shimmed, so the
Maven download runs outside the sfw-wrapped process tree and succeeds.

* chore(ci): remove the unused maven-extension-jar workflow

The standalone PR-time jar-build workflow doesn't run behind Socket Firewall, so
it never exercised the environment the release actually uses (and gave false
confidence). The jar is built in the release workflow and the version-compat
matrix runs locally via run-compat.sh, so drop it.

* bump coana cli version

Author: jfblaa

.github/workflows/maven-extension-jar.yml

@@ -206,15 +206,19 @@ jobs:
 
       # Compile the Maven manifest extension jar so the dist build bundles it
       # into dist/manifest-scripts (the jar is never committed; it ships only in
-      # the published package). The org action allowlist forbids actions/setup-java,
-      # so use a JDK pre-installed on the runner image (JAVA_HOME_17_X64), falling
-      # back to the runner's default `java`. build-jar.sh uses the Maven wrapper.
+      # the published package). Invoke build-jar.sh directly, NOT via `pnpm run`:
+      # Socket Firewall wraps the package managers (npm/pnpm/...) it shims, so a
+      # `pnpm run` would route the Maven wrapper's download through sfw, which
+      # fails on the non-package fetch. Running bash directly keeps the Maven
+      # download outside the shimmed process tree. The org action allowlist forbids
+      # actions/setup-java, so use a JDK pre-installed on the runner image
+      # (JAVA_HOME_17_X64), falling back to the runner's default `java`.
       - name: Build Maven manifest extension jar
         run: |
           if [ -n "${JAVA_HOME_17_X64:-}" ]; then
             export JAVA_HOME="$JAVA_HOME_17_X64"
           fi
-          pnpm run build:maven-extension
+          bash src/commands/manifest/scripts/maven-extension/build-jar.sh
 
       - run: INLINED_SOCKET_CLI_PUBLISHED_BUILD=1 pnpm run build:dist
       - name: Publish socket

.github/workflows/provenance.yml

@@ -9,7 +9,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 ### Changed
 - More reliable reachability for Gradle, sbt, and Maven projects with dynamic versions (git versions, CI build numbers, timestamps): the build is resolved once and its artifact paths reused, avoiding spurious "failed to install" errors.
 - `socket manifest` and `--auto-manifest` now prefer your project's build-tool wrapper (`./gradlew`, `./mvnw`) when present, falling back to `gradle`/`mvn` on PATH.
-- Updated the Coana CLI to v `15.6.3`.
+- Updated the Coana CLI to v `15.6.6`.
 
 ## [1.1.131](https://github.com/SocketDev/socket-cli/releases/tag/v1.1.131) - 2026-06-29
 

CHANGELOG.md

@@ -97,7 +97,7 @@
     "@babel/preset-typescript": "7.27.1",
     "@babel/runtime": "7.28.4",
     "@biomejs/biome": "2.2.4",
-    "@coana-tech/cli": "15.6.3",
+    "@coana-tech/cli": "15.6.6",
     "@cyclonedx/cdxgen": "12.1.2",
     "@dotenvx/dotenvx": "1.49.0",
     "@eslint/compat": "1.3.2",