fix(ci): use package-token capable publish workflow

[Jess Sullivan (Jesssullivan)]

Summary

• update the reusable js-bazel-package.yml pin to ci-templates#22
• keep the existing publish trigger behavior while allowing the inherited GITHUB_PACKAGES_TOKEN secret to be used for GitHub Packages publication

Validation

• ruby -e 'require "yaml"; YAML.load_file(".github/workflows/ci.yml")'
• git diff --check

[greptile-apps]

Greptile Summary

This PR bumps the pinned SHA for the reusable js-bazel-package.yml workflow from 53f0326... to 0d88ad7... (corresponding to ci-templates#22), enabling the inherited GITHUB_PACKAGES_TOKEN secret to be used for GitHub Packages publication. All other workflow inputs, trigger logic, and permissions are unchanged.

Confidence Score: 5/5

Safe to merge — minimal, targeted SHA pin update with no logic changes.

The only change is a SHA reference bump for a trusted internal org workflow. SHA pinning is the correct security practice, secrets: inherit and packages: write permission were already present before this PR, and the publish trigger logic is unaffected.

No files require special attention.

Important Files Changed

Filename	Overview
.github/workflows/ci.yml	Updates the pinned SHA for the reusable js-bazel-package.yml workflow from 53f0326... to 0d88ad7... to enable GITHUB_PACKAGES_TOKEN-based publication; no other changes.

Sequence Diagram

sequenceDiagram
    participant GH as GitHub Actions
    participant CI as ci.yml (tinyland-security)
    participant TPL as js-bazel-package.yml@0d88ad7<br/>(ci-templates#22)
    participant GPR as GitHub Packages Registry

    GH->>CI: trigger (push/tag/PR/dispatch)
    CI->>TPL: call reusable workflow<br/>(secrets: inherit)
    TPL->>TPL: build, typecheck, test
    alt publish == true OR tag push
        TPL->>GPR: publish @tinyland-inc/tinyland-security<br/>using GITHUB_PACKAGES_TOKEN
    else
        TPL->>TPL: dry_run (no publish)
    end
    TPL-->>CI: workflow result

Loading

_{Reviews (1): Last reviewed commit: "fix(ci): use package-token capable publi..." | Re-trigger Greptile}