fix(ci): make github package artifact writable

[Jesssullivan]

Summary

• make the copied pkg-github directory writable after extracting the Bazel artifact
• avoid EACCES when the GitHub Packages sidecar rewrites package.json on self-hosted runners
• keep the npmjs.com publish lane and GitHub Packages sidecar consistent

Validation

• workflow-only change
• based on the failing self-hosted publish log pattern already seen in the corrected publish lane

[greptile-apps]

Greptile Summary

Adds chmod -R u+w pkg-github to the publish-github job after copying the Bazel artifact, preventing EACCES errors when the GitHub Packages step rewrites package.json on self-hosted runners where Bazel outputs are extracted as read-only. The publish-npm job is unaffected since it never mutates the artifact directory.

Confidence Score: 5/5

Safe to merge — the fix is minimal and targeted, with one pre-existing P2 dry-run inconsistency noted.

The only open finding is a P2: the dry-run path in publish-github doesn't apply the package.json rewrite, so it doesn't fully simulate the real publish. This is a pre-existing gap not introduced by this PR and does not block merge.

No files require special attention.

Important Files Changed

Filename	Overview
.github/workflows/publish.yml	Adds chmod -R u+w pkg-github after cp -R pkg pkg-github in the publish-github job to fix EACCES errors when Bazel's read-only artifacts are copied and then mutated on self-hosted runners.

Sequence Diagram

sequenceDiagram
    participant T as test job
    participant A as artifact store
    participant N as publish-npm job
    participant G as publish-github job
    participant NPM as npmjs.com
    participant GHP as GitHub Packages

    T->>T: bazelisk build //:pkg
    T->>T: tar -czf bazel-pkg.tgz -C bazel-bin pkg
    T->>A: upload bazel-pkg artifact

    A->>N: download bazel-pkg
    N->>N: tar -xzf bazel-pkg.tgz
    Note over N: pkg/ files are read-only (Bazel default)
    N->>NPM: npm publish ./pkg

    A->>G: download bazel-pkg
    G->>G: tar -xzf bazel-pkg.tgz
    Note over G: pkg/ files are read-only (Bazel default)
    G->>G: cp -R pkg pkg-github
    G->>G: chmod -R u+w pkg-github (this PR)
    G->>G: node -e rewrite package.json name + publishConfig
    G->>GHP: npm publish ./pkg-github --ignore-scripts

Loading

Comments Outside Diff (1)

1. .github/workflows/publish.yml, line 157-161 (link)

   Dry-run skips package.json rewrite

   The "Publish dry run" step publishes from pkg-github without the scope/registry override applied in the preceding "Publish to GitHub Packages" step (which is skipped when dry_run == 'true'). The dry run therefore exercises a different package.json than the real publish, so it won't catch a scope or publishConfig mistake. Consider moving the package.json mutation into the prepare step (or a dedicated step with no condition) so both paths use the same artifact.

_{Reviews (1): Last reviewed commit: "fix(ci): make github package artifact wr..." | Re-trigger Greptile}