fix(ci): use nonreserved github packages token

[Jess Sullivan (Jesssullivan)]

Pins the package Publish workflow to the non-reserved token contract from ci-templates#24 and passes TINYLAND_GITHUB_PACKAGES_TOKEN where the workflow uses explicit secret mapping.

GitHub rejects custom Actions secret names beginning with GITHUB_, so the previous GITHUB_PACKAGES_TOKEN wiring could never be installed as an org secret.

Tracking: TIN-713

[greptile-apps]

Greptile Summary

Renames the passed secret from GITHUB_PACKAGES_TOKEN to TINYLAND_GITHUB_PACKAGES_TOKEN so it can be installed as an org secret — GitHub silently rejects any custom secret name that starts with GITHUB_. The reusable-workflow SHA is bumped to the matching commit in ci-templates (PR #24) that expects the new name.

Confidence Score: 5/5

Safe to merge — the change is a targeted secret rename and SHA pin with no logic changes.

Only one file changed; both edits are mechanical (secret rename to avoid a GitHub-reserved prefix, SHA bump to the corresponding upstream commit). No logic, permissions, or other workflow behaviour is altered.

No files require special attention.

Important Files Changed

Filename	Overview
.github/workflows/publish.yml	Bumps the pinned reusable-workflow SHA and renames the secret from GITHUB_PACKAGES_TOKEN to TINYLAND_GITHUB_PACKAGES_TOKEN to avoid the GitHub-reserved GITHUB_ prefix

Sequence Diagram

sequenceDiagram
    participant GH as GitHub Actions
    participant PW as publish.yml
    participant RT as ci-templates/js-bazel-package.yml (SHA 82308d0)
    participant NPM as npm Registry
    participant GHPKG as GitHub Packages

    GH->>PW: trigger (release published / workflow_dispatch)
    PW->>RT: uses reusable workflow with secrets: NPM_TOKEN, TINYLAND_GITHUB_PACKAGES_TOKEN
    RT->>NPM: publish (NPM_TOKEN)
    RT->>GHPKG: publish (TINYLAND_GITHUB_PACKAGES_TOKEN)

Loading

_{Reviews (1): Last reviewed commit: "fix(ci): use nonreserved github packages..." | Re-trigger Greptile}