Fix release publishing pipelines for all languages

[konard]

Fixes the failing/broken publish jobs so registries actually receive updates when versions are released.

Root causes found and fixed

C# — pushToNuget failing on every main push (red csharp workflow)

The version-existence check hit api.nuget.org/v3-flatcontainer/Link.Foundation.Links.Notation/... with a mixed-case package id — the flat-container API is lowercase-only from CI runners, so the check always said "version does not exist", the job re-pushed the already-published 0.13.0 (on NuGet since 2025-12-01), and nuget.org rejected it with 403. The URL is now lowercased, so existing versions are skipped and the workflow goes green.

Java — publishToMavenCentral failing on every main push (red java workflow)

Two independent problems:

1. No GPG key or Sonatype credentials exist in repo/org secrets → gpg: signing failed: No secret key.
2. The pom deployed to s01.oss.sonatype.org (OSSRH), which Sonatype decommissioned in June 2025 — even with credentials it could never publish.

Migrated to the Central Portal (central-publishing-maven-plugin, server-id central), and the job now skips with a warning instead of failing when credentials are missing.

Rust — next release would fail

links-notation now depends on links-notation-macro, which has never been published to crates.io — the next cargo publish would be rejected. The workflow now publishes the macro crate first (tolerating already-exists). Verified with cargo publish --dry-run.

Go — no versioning at all

js/python/rust/csharp all have 0.13.0 tags, but Go has none, so go get ...@v0.13.0 cannot work. Added a publishRelease job that creates go/vX.Y.Z tags (the required format for submodule Go modules) driven by a new go/VERSION file (set to 0.13.0).

All languages — GitHub releases silently never created

Every publishRelease job's if: referenced needs.findChangedXFiles.outputs... without listing that job in needs: — GitHub evaluates the missing context as empty, the condition is always false, and release tagging has been silently skipped since the workflows were restructured. Added the missing needs: entries in all five workflows.

⚠️ Secrets the repo owner must add (cannot be fixed from CI)

Secret	Needed for	Where to get it
CENTRAL_USERNAME / CENTRAL_TOKEN	Maven Central	https://central.sonatype.com/account → Generate User Token
GPG_PRIVATE_KEY / GPG_PASSPHRASE	Signing Java artifacts	gpg --armor --export-secret-keys
NPM_TOKEN	npm publishing	Existed in Dec 2025 (0.13.0 published fine) but is now absent — next JS release will fail until re-added

NUGET_TOKEN, PYPI_TOKEN, and org-level CARGO_TOKEN are present. The NuGet 403 may disappear entirely with the fixed version check; if a future genuine push still 403s, the key needs rotation.

Verification

• All workflow YAML validated
• mvn help:effective-pom -Prelease resolves the new central-publishing plugin
• cargo publish -p links-notation-macro --dry-run packages and verifies cleanly

🤖 Generated with Claude Code