ci: pin idempotent package publish template

[Jess Sullivan (Jesssullivan)]

Pins the shared js-bazel-package workflow to the TIN-713 idempotent publish template.

This keeps existing package publishes from failing when npmjs or GitHub Packages already has the same version.
Proof run: tinyland-inc/tinyland-stores/actions/runs/25092503866.

[greptile-apps]

Greptile Summary

This PR updates the pinned commit SHA for the shared js-bazel-package reusable workflow in .github/workflows/publish.yml from 82308d0 to f23f67b, pointing to the idempotent-publish template introduced in TIN-713. The change prevents publish jobs from failing when the same package version already exists on npmjs or GitHub Packages.

Confidence Score: 5/5

Safe to merge — single-line SHA bump to a pinned reusable workflow with no other changes.

The change is minimal (one SHA substitution), continues to use a fully-pinned commit reference (security best practice), and is backed by a successful proof run cited in the PR description. No logic, secrets, or permissions are modified.

No files require special attention.

Important Files Changed

Filename	Overview
.github/workflows/publish.yml	Bumps the pinned SHA of the shared js-bazel-package reusable workflow to the idempotent-publish template commit; no other changes.

Sequence Diagram

sequenceDiagram
    participant GH as GitHub (release / workflow_dispatch)
    participant PW as publish.yml
    participant CT as ci-templates js-bazel-package@f23f67b
    participant NPM as npmjs / GitHub Packages

    GH->>PW: trigger (release published or manual dry_run)
    PW->>CT: call reusable workflow (pinned SHA)
    CT->>CT: typecheck, test, build, package-check
    CT->>NPM: publish (idempotent — skip if version already exists)
    NPM-->>CT: success (or "already exists" — no failure)
    CT-->>PW: workflow complete

Loading

_{Reviews (1): Last reviewed commit: "ci: pin idempotent package publish templ..." | Re-trigger Greptile}