the packagist validation rules defined in the PAckage entity don't prevent using a local gitlab at all, while your regex does.

Packagist has packages which are not on github (though most of them are). Some of them live in bitbucket for instance.