fix(bazel): resolve tinyland registry deps in standalone build

[Jess Sullivan (Jesssullivan)]

Layer 1 repair following security#2 pattern. Validation: typecheck ✓, build ✓, check:package ✓

[greptile-apps]

Greptile Summary

This PR makes tinyland-activitypub buildable in standalone (non-monorepo) Bazel mode by adding the private tinyland-inc/bazel-registry to .bazelrc, renaming the npm extension to tummycrypt_tinyland_activitypub_npm to avoid name collisions, rewiring all @npm// load paths in BUILD.bazel, and replacing the monorepo local-path dep on content-types with the pnpm-lockfile-resolved :node_modules. The CI template SHA is also bumped to pick up registry-aware build support.

Confidence Score: 5/5

Safe to merge — all findings are P2 (cleanup suggestions), and the author confirms typecheck, build, and package checks pass.

No P0 or P1 issues found. The only open question is whether bazel_dep(tummycrypt_tinyland_content_types) is still needed now that BUILD.bazel no longer references it directly, but this is a harmless dead-declaration at worst.

No files require special attention.

Important Files Changed

Filename	Overview
.bazelrc	Adds private Bazel registry (tinyland-inc) before BCR so standalone builds can resolve tinyland modules; registry URL is pinned to a mutable main branch ref (already flagged)
MODULE.bazel	Renames npm extension to tummycrypt_tinyland_activitypub_npm to avoid collisions in standalone mode; bumps content-types dep to 0.2.3; use_repo correctly updated to match
BUILD.bazel	Rewires all @npm// load paths to @tummycrypt_tinyland_activitypub_npm//; drops monorepo-path dep on content-types in favour of pnpm-resolved :node_modules
.github/workflows/ci.yml	Bumps pinned SHA of the reusable CI template to pick up registry-aware build support; both old and new refs are commit SHAs, so reproducibility is maintained

Sequence Diagram

sequenceDiagram
    participant Bazel
    participant PrivateReg as tinyland-inc/bazel-registry
    participant BCR as bcr.bazel.build
    participant npm as tummycrypt_tinyland_activitypub_npm

    Bazel->>PrivateReg: resolve tummycrypt_tinyland_content_types@0.2.3
    PrivateReg-->>Bazel: module metadata
    Bazel->>BCR: resolve aspect_rules_js, aspect_rules_ts, etc.
    BCR-->>Bazel: module metadata

    Bazel->>npm: npm_translate_lock (pnpm-lock.yaml)
    npm-->>Bazel: @tummycrypt_tinyland_activitypub_npm repo

    Bazel->>Bazel: load @tummycrypt_tinyland_activitypub_npm//:defs.bzl
    Bazel->>Bazel: npm_link_all_packages → :node_modules
    Bazel->>Bazel: ts_project(deps=[:node_modules, :node_modules/@types/node])

Loading

_{Reviews (4): Last reviewed commit: "ci: use authenticated Bazel package work..." | Re-trigger Greptile}

[greptile-apps]

Mutable registry URL branch reference

The registry URL pins to the main branch, so any push to main in tinyland-inc/bazel-registry immediately changes which module metadata Bazel fetches — breaking reproducibility and creating a supply-chain window. Pinning to a commit SHA or a tag makes the lockstep explicit and auditable.

Suggested change

	common --registry=https://raw.githubusercontent.com/tinyland-inc/bazel-registry/main
	common --registry=https://raw.githubusercontent.com/tinyland-inc/bazel-registry/<commit-sha-or-tag>