fix: make publish workflow self-hosted-safe

[Jesssullivan]

Summary

• publish to npm without provenance on self-hosted runners
• publish GitHub Packages from a writable copy of the Bazel artifact

Why

The self-hosted honey runner lane cannot use npm provenance, and the current GitHub Packages step mutates a read-only downloaded artifact. This keeps future package publishes truthful instead of reporting false greens or failing on the sidecar path.

[greptile-apps]

Greptile Summary

This PR makes the publish workflow compatible with self-hosted runners by: routing all jobs through PRIMARY_LINUX_RUNNER_LABELS_JSON, conditionally omitting --provenance on self-hosted runners (which lack OIDC), copying the Bazel artifact to pkg-github before mutating its package.json for GitHub Packages, and locking the pnpm store to a workspace-relative path for consistent cache keys across runner types. The logic is sound and the changes directly address the stated problems.

Confidence Score: 5/5

Safe to merge — all three fixes are correct and no P0/P1 issues found.

The provenance skip correctly uses runner.environment == 'self-hosted', the artifact copy properly isolates the GitHub Packages mutation from the read-only download, and the workspace-relative pnpm store ensures consistent cache keys on self-hosted runners. No logic errors, no security regressions, and the behavior is otherwise unchanged on GitHub-hosted runners.

No files require special attention.

Important Files Changed

Filename	Overview
.github/workflows/publish.yml	Adds self-hosted runner support across all three jobs, conditionally skips --provenance on self-hosted runners, copies the Bazel artifact before mutating it for GitHub Packages, and switches pnpm store to a workspace-relative path for consistent caching.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A([Release / workflow_dispatch]) --> B[test job\nBazel build · unit tests · publint]
    B --> C[Upload bazel-pkg artifact]

    C --> D[publish-npm]
    C --> E[publish-github]

    D --> F{dry_run == true?}
    F -- Yes --> G[npm publish --dry-run]
    F -- No --> H{runner.environment\n== self-hosted?}
    H -- Yes --> I[npm publish\n--access public\nno provenance]
    H -- No --> J[npm publish\n--access public\n--provenance]

    E --> K[cp -R pkg pkg-github]
    K --> L{dry_run == true?}
    L -- Yes --> M[npm publish ./pkg-github --dry-run\nnote: package.json not yet mutated]
    L -- No --> N[Mutate pkg-github/package.json\nscope + registry override]
    N --> O[npm publish ./pkg-github]

Loading

_{Reviews (1): Last reviewed commit: "fix: make publish workflow self-hosted-s..." | Re-trigger Greptile}