docs: add release and add-lint-rule runbooks, fix stale Maven steps

[yoheimuta]

Documents this repo's two recurring jobs as Claude Code skills, and corrects a set of release instructions that no longer match what CI does. Fallout from shipping v0.57.0 (#557).

The stale part

CONTRIBUTING.md told maintainers to promote Maven artifacts by hand:

Head over to https://s01.oss.sonatype.org/#stagingRepositories … verify the contents of the staging repo and close it

That has not been true for a while. goreleaser.yml uploads to the Central Publisher Portal with publishing_type=automatic, and today's release confirms it — nobody touched a staging repo, yet:

$ curl -s https://repo1.maven.org/maven2/io/github/yoheimuta/protoc-gen-protolint/maven-metadata.xml
  <release>0.57.0</release>
  <lastUpdated>20260814103515</lastUpdated>

which is minutes after the goreleaser run finished.

.claude/skills/release

Releasing is more than release.sh. One tag fans out to six channels, and publish_npm / publish_wheel trigger on goreleaser's completion, not its success — so a green goreleaser badge is not evidence that anything was published. That is exactly how the npm package sat a year behind while every other channel kept shipping.

The runbook therefore leans on verifying the registries directly rather than the workflow badges, plus an end-to-end npm install that exercises postinstall.js. It also records the failure modes hit while shipping v0.57.0, so the next person does not have to re-derive them:

• 404 ... PUT https://registry.npmjs.org/protolint means auth, not a missing package
• renaming publish_npm.yml breaks publishing, because the trusted publisher registration matches on the filename
• fatal: No tags can describe '<sha>' is a shallow-checkout problem
• the bin[...] was invalid and removed warning is harmless
• never re-tag to fix a failed channel; re-run the workflow

.claude/skills/add-lint-rule

Adding a rule spans eight files. Implementing Apply without registering the rule in internal/cmd/subcmds/rules.go leaves it invisible to users, and IsOfficial() quietly decides whether it is enabled by default (Rules.Default() filters on it). The skill tabulates every file to touch, the mechanical naming convention, and how fixable / auto-disable are wired.

Verified go run cmd/protolint/main.go list behaves as the skill describes.

Also

• README.md gains a pointer from its Release section to the full process
• .claude/settings.local.json is gitignored — it is per-developer, and was previously only ignored via a personal global gitignore

🤖 Generated with Claude Code