Tune make dist: drop generated/build artifacts, add missing sources

Adjust what "make dist" ships in the release tarball.

Dropped (build output and generated code that a built tree leaves behind,
swept in via whole-directory EXTRA_DIST entries and pruned in dist-hook;
none of it is tracked, so a clean checkout never contained it):
- lib/haxe/test/{bin,gen-haxe}, lib/javame/gen-javame
- lib/netstd bin/obj/gen-netstd across the test and benchmark projects
- test/netstd/{Client,Server}/ThriftTest
- tutorial/netstd/Interfaces/{shared,tutorial} (tracked project
  scaffolding is kept so the tutorial still builds from the tarball)
- test/cpp/gen-cpp* (nodist generated sources)
- build/__pycache__ and stray *.pyc
Also no longer shipped: the .github/ CI configuration and
doc/thrift-threat-model.md.

Added (tracked sources that were missing from EXTRA_DIST):
- lib/lua/test/{RecursionDepth.thrift,test_recursion_depth.lua}
- lib/netstd/Tests/codegen/run-NetStd-Codegen-Tests.ps1
- test/JsRecursionDepthTest.thrift
- lib/php/{phpstan.neon,phpstan-baseline.neon}
- SECURITY.md

Verified end-to-end with make dist in a clean container: 4317 -> 3480
tarball entries, and the only tracked files removed are .github/* and
doc/thrift-threat-model.md.

Client: netstd,haxe,javame,lua,php,cpp

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: Jens-G

Makefile.am

@@ -66,6 +66,9 @@ dist-hook:
 	find $(distdir) -type d \( -iname ".deps" -or -iname ".libs" \) | xargs rm -rf
 	find $(distdir) -type d \( -iname ".svn" -or -iname ".git" \) | xargs rm -rf
 	find $(distdir) -type d -name node_modules -prune -exec rm -rf {} +
+	find $(distdir) -type d -name __pycache__ -prune -exec rm -rf {} +
+	find $(distdir) -type f -name "*.pyc" -exec rm -f {} +
+	rm -f $(distdir)/doc/thrift-threat-model.md
 
 print-version:
 	@echo $(PACKAGE_VERSION)
@@ -143,13 +146,6 @@ EXTRA_DIST = \
 	.flake8 \
 	.gitattributes \
 	.gitignore \
-	.github/dependabot.yml \
-	.github/pull_request_template.md \
-	.github/stale.yml \
-	.github/workflows/build.yml \
-	.github/workflows/cmake.yml \
-	.github/workflows/pypi.yml \
-	.github/workflows/release_rust.yml \
 	.travis.yml \
 	ApacheThrift.nuspec \
 	AGENTS.md \
@@ -178,5 +174,6 @@ EXTRA_DIST = \
 	package-lock.json \
 	phpcs.xml.dist \
 	README.md \
+	SECURITY.md \
 	rust-toolchain \
 	sonar-project.properties

lib/Makefile.am

@@ -101,6 +101,12 @@ endif
 distdir:
 	$(MAKE) $(AM_MAKEFLAGS) distdir-am
 
+# The libs below ship as whole directories, which sweeps in generated code and
+# build output present in a built tree.  Strip those from the distribution.
+dist-hook:
+	rm -rf $(distdir)/haxe/test/bin $(distdir)/haxe/test/gen-haxe
+	rm -rf $(distdir)/javame/gen-javame
+
 EXTRA_DIST = \
 	d \
 	dart \

lib/lua/Makefile.am

@@ -73,4 +73,6 @@ EXTRA_DIST = \
 		TProtocol.lua \
 		TServer.lua \
 		TSocket.lua \
-		TTransport.lua
+		TTransport.lua \
+		test/RecursionDepth.thrift \
+		test/test_recursion_depth.lua

lib/netstd/Makefile.am

@@ -67,10 +67,16 @@ clean-local:
 distdir:
 	$(MAKE) $(AM_MAKEFLAGS) distdir-am
 
+# Several test/benchmark projects ship as whole directories; strip the build
+# output and generated code that a built tree leaves behind.
+dist-hook:
+	find $(distdir) -type d \( -name bin -o -name obj -o -name gen-netstd \) -prune -exec rm -rf {} +
+
 EXTRA_DIST = \
 	README.md \
 	Directory.Build.props \
 	Benchmarks/Thrift.Benchmarks \
+	Tests/codegen/run-NetStd-Codegen-Tests.ps1 \
 	Tests/Thrift.IntegrationTests/Protocols \
 	Tests/Thrift.IntegrationTests/Thrift.IntegrationTests.csproj \
 	Tests/Thrift.Compile.Tests \

lib/php/Makefile.am

@@ -140,6 +140,8 @@ EXTRA_DIST = \
 	src/ext/thrift_protocol/php_thrift_protocol_arginfo.h \
 	coding_standards.md \
 	thrift_protocol.ini \
+	phpstan.neon \
+	phpstan-baseline.neon \
 	phpunit.xml \
 	README.apache.md \
 	README.md \

test/Makefile.am

@@ -158,6 +158,7 @@ EXTRA_DIST = \
 	index.html \
 	Int64Test.thrift \
 	JsDeepConstructorTest.thrift \
+	JsRecursionDepthTest.thrift \
 	keys/keygen/.gitignore \
 	known_failures_Linux.json \
 	ManyOptionals.thrift \

test/cpp/Makefile.am

@@ -260,6 +260,10 @@ style-local:
 distdir:
 	$(MAKE) $(AM_MAKEFLAGS) distdir-am
 
+# The gen-cpp* trees are nodist generated sources; drop them from the dist.
+dist-hook:
+	find $(distdir) -type d -name 'gen-cpp*' -prune -exec rm -rf {} +
+
 EXTRA_DIST = \
 	src/TestClient.cpp \
 	src/TestServer.cpp \

test/netstd/Makefile.am

@@ -35,6 +35,12 @@ clean-local:
 distdir:
 	$(MAKE) $(AM_MAKEFLAGS) distdir-am
 
+# Client and Server ship as whole directories; strip the generated code and
+# build output a built tree leaves behind.
+dist-hook:
+	rm -rf $(distdir)/Client/ThriftTest $(distdir)/Server/ThriftTest
+	find $(distdir) -type d \( -name bin -o -name obj \) -prune -exec rm -rf {} +
+
 EXTRA_DIST = \
 	Client \
 	README.md \

tutorial/netstd/Makefile.am

@@ -34,6 +34,12 @@ clean-local:
 distdir:
 	$(MAKE) $(AM_MAKEFLAGS) distdir-am
 
+# The projects ship as whole directories; strip the generated code and build
+# output a built tree leaves behind, keeping the tracked project scaffolding.
+dist-hook:
+	rm -rf $(distdir)/Interfaces/shared $(distdir)/Interfaces/tutorial
+	find $(distdir) -type d \( -name bin -o -name obj \) -prune -exec rm -rf {} +
+
 EXTRA_DIST = \
 	Client \
 	Interfaces \