ci: pin idempotent package publish template

[Jess Sullivan (Jesssullivan)]

Pins the shared js-bazel-package workflow to the TIN-713 idempotent publish template.

This keeps existing package publishes from failing when npmjs or GitHub Packages already has the same version.
Proof run: tinyland-inc/tinyland-stores/actions/runs/25092503866.

[greptile-apps]

Greptile Summary

This PR updates the pinned commit SHA for the reusable js-bazel-package.yml CI template from 82308d0 to f23f67b, switching to an idempotent publish variant that gracefully handles re-publishing an already-existing package version to npmjs or GitHub Packages.

Confidence Score: 5/5

Safe to merge — single-line SHA pin update to a known internal CI template commit.

The change is a one-line SHA bump in a reusable workflow reference with no logic changes in this repository. The new SHA is explicitly tied to a tracked internal template (TIN-713) with a cited proof run. No secrets, permissions, or logic in this repo are modified.

No files require special attention.

Important Files Changed

Filename	Overview
.github/workflows/publish.yml	Updates the pinned SHA for the reusable js-bazel-package workflow to the idempotent publish template version (TIN-713), preventing failures on duplicate version publishes to npmjs or GitHub Packages.

Sequence Diagram

sequenceDiagram
    participant GH as GitHub Release Event
    participant PY as publish.yml
    participant CT as ci-templates/js-bazel-package.yml@f23f67b
    participant NPM as npmjs
    participant GHP as GitHub Packages

    GH->>PY: release published (or workflow_dispatch)
    PY->>CT: uses reusable workflow (pinned SHA)
    CT->>CT: build & test (pnpm build, typecheck, unit tests)
    CT->>NPM: publish (idempotent — skip if version exists)
    CT->>GHP: publish (idempotent — skip if version exists)

Loading

_{Reviews (1): Last reviewed commit: "ci: pin idempotent package publish templ..." | Re-trigger Greptile}