It's a pretty low risk if you don't put your identity out there. I know there's at least one Git forge that's a Tor onion service. Even on GitHub 99% of the time this ends with a DMCA takedown of the repository. You should probably put it on a pseudonymous alt account but you don't actually need to use a Tor onion service.
You could also get someone else to put their name on the web hosting and so on. Don't know who exactly, but there are a lot more people willing to take legal risk of having reverse-engineered an FPGA toolchain, than people who can reverse-engineer an FPGA toolchain. Doing the work is what's most important, and the rest can be figured out later. But you don't even see that. You don't see people being like "I reverse-engineered Vivado but I won't give you a copy because I could get sued."
It's a pretty low risk if you don't put your identity out there. I know there's at least one Git forge that's a Tor onion service. Even on GitHub 99% of the time this ends with a DMCA takedown of the repository. You should probably put it on a pseudonymous alt account but you don't actually need to use a Tor onion service.
You could also get someone else to put their name on the web hosting and so on. Don't know who exactly, but there are a lot more people willing to take legal risk of having reverse-engineered an FPGA toolchain, than people who can reverse-engineer an FPGA toolchain. Doing the work is what's most important, and the rest can be figured out later. But you don't even see that. You don't see people being like "I reverse-engineered Vivado but I won't give you a copy because I could get sued."