fix(javascript): fix hps release (#3577)

## Why?



## What does this PR do?



## Related issues



## AI Contribution Checklist



- [ ] Substantial AI assistance was used in this PR: `yes` / `no`
- [ ] If `yes`, I included a completed [AI Contribution
Checklist](https://github.com/apache/fory/blob/main/AI_POLICY.md#9-contributor-checklist-for-ai-assisted-prs)
in this PR description and the required `AI Usage Disclosure`.
- [ ] If `yes`, my PR description includes the required `ai_review`
summary and screenshot evidence of the final clean AI review results
from both fresh reviewers on the current PR diff or current HEAD after
the latest code changes.



## Does this PR introduce any user-facing change?



- [ ] Does this PR introduce any public API change?
- [ ] Does this PR introduce any binary protocol compatibility change?

## Benchmark

Author: chaokunyang

.github/workflows/release-compiler.yaml

@@ -55,7 +55,7 @@ jobs:
           python -m build --sdist --wheel
 
       - name: Publish to TestPyPI
-        uses: pypa/gh-action-pypi-publish@release/v1
+        uses: pypa/gh-action-pypi-publish@76f52bc884231f62b9a034ebfe128415bbaabdfc  # v1.14.0
         if: ${{ contains(github.ref_name, '-') }}
         with:
           repository-url: https://test.pypi.org/legacy/
@@ -65,7 +65,7 @@ jobs:
           packages-dir: compiler/dist
 
       - name: Publish to PyPI
-        uses: pypa/gh-action-pypi-publish@release/v1
+        uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e  # v1.14.0
         if: ${{ !contains(github.ref_name, '-') }}
         with:
           skip-existing: true

.github/workflows/release-python.yaml

@@ -52,7 +52,7 @@ jobs:
           echo "head_branch: ${{ github.event.workflow_run.head_branch }}"
 
       - name: Publish to TestPyPI
-        uses: pypa/gh-action-pypi-publish@release/v1
+        uses: pypa/gh-action-pypi-publish@76f52bc884231f62b9a034ebfe128415bbaabdfc  # v1.14.0
         if: startsWith(github.event.workflow_run.head_branch, 'v') && contains(github.event.workflow_run.head_branch, '-')
         with:
           repository-url: https://test.pypi.org/legacy/
@@ -62,7 +62,7 @@ jobs:
           packages-dir: dist
 
       - name: Publish to PyPI
-        uses: pypa/gh-action-pypi-publish@release/v1
+        uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e  # v1.14.0
         if: startsWith(github.event.workflow_run.head_branch, 'v') && !contains(github.event.workflow_run.head_branch, '-')
         with:
           skip-existing: true

javascript/packages/hps/package.json

@@ -16,6 +16,7 @@
     "prepublishOnly": "npm run build"
   },
   "license": "Apache-2.0",
+  "repository": "git@github.com:apache/fory.git",
   "dependencies": {
     "bindings": "~1.2.1",
     "fs-extra": "^11.3.0",