From d2498f18250cdf5cb4292b2c9285c32b141e31e4 Mon Sep 17 00:00:00 2001
From: Levin Dixon <levin.dixon@intercom.io>
Date: Wed, 23 Sep 2026 14:06:08 +0100
Subject: [PATCH] Re-enable the TypeScript SDK release workflow

Move ts-sdk.yml back into .github/workflows. The release job now runs
in the main environment, which is the only place FERN_TOKEN exists and
whose branch policy limits it to runs from main. Pin actions/checkout,
actions/setup-node and pnpm/action-setup to commits, declare read-only
permissions, stop persisting git credentials, serialise runs, and cap
the job at 30 minutes. The version input is validated as semver and
passed through an environment variable instead of being interpolated
into the shell.

Drop FERN_NPM_TOKEN from both the workflow and the ts-sdk generator
output. intercom-node publishes to npm through its own release
workflow, and Fern only opens a pull request there. Fern's config
loader fails on an undefined ${VAR}, so the two removals go together.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 .github/workflows-disabled/ts-sdk.yml | 32 ---------------
 .github/workflows/ts-sdk.yml          | 56 +++++++++++++++++++++++++++
 fern/generators.yml                   |  1 -
 3 files changed, 56 insertions(+), 33 deletions(-)
 delete mode 100644 .github/workflows-disabled/ts-sdk.yml
 create mode 100644 .github/workflows/ts-sdk.yml

diff --git a/.github/workflows-disabled/ts-sdk.yml b/.github/workflows-disabled/ts-sdk.yml
deleted file mode 100644
index b57941bd..00000000
--- a/.github/workflows-disabled/ts-sdk.yml
+++ /dev/null
@@ -1,32 +0,0 @@
-name: Release TypeScript SDK
-
-on:
-  workflow_dispatch:
-    inputs:
-      version:
-        description: "The version of the SDKs that you would like to release"
-        required: true
-        type: string
-
-jobs:
-  release:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout repo
-        uses: actions/checkout@v3
-
-      - name: Setup node
-        uses: actions/setup-node@v4
-
-      - name: Install pnpm
-        uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4.3.0
-
-      - name: Download Fern
-        run: pnpm add -g fern-api@5.65.3
-
-      - name: Release SDKs
-        env:
-          FERN_TOKEN: ${{ secrets.FERN_TOKEN }}
-          FERN_NPM_TOKEN: ${{ secrets.FERN_NPM_TOKEN }}
-        run: |
-          fern generate --group ts-sdk --version ${{ inputs.version }} --log-level debug
diff --git a/.github/workflows/ts-sdk.yml b/.github/workflows/ts-sdk.yml
new file mode 100644
index 00000000..ce43655d
--- /dev/null
+++ b/.github/workflows/ts-sdk.yml
@@ -0,0 +1,56 @@
+name: Release TypeScript SDK
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: "The version of the SDKs that you would like to release"
+        required: true
+        type: string
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}
+  cancel-in-progress: false
+
+jobs:
+  release:
+    name: Release
+    runs-on: ubuntu-latest
+    # FERN_TOKEN is an environment secret; only runs from main can reach it.
+    environment: main
+    timeout-minutes: 30
+    steps:
+      - name: Checkout repo
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Setup node
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 22
+          package-manager-cache: false
+
+      - name: Install pnpm
+        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
+
+      - name: Download Fern
+        run: pnpm add -g fern-api@5.65.3
+
+      - name: Validate version input
+        env:
+          VERSION: ${{ inputs.version }}
+        run: |
+          if ! [[ "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?$ ]]; then
+            echo "version must look like 7.0.5 or 7.0.5-beta.0, got: $VERSION"
+            exit 1
+          fi
+
+      - name: Release SDKs
+        env:
+          FERN_TOKEN: ${{ secrets.FERN_TOKEN }}
+          VERSION: ${{ inputs.version }}
+        run: fern generate --group ts-sdk --version "$VERSION" --log-level debug
diff --git a/fern/generators.yml b/fern/generators.yml
index 3a87074b..bce83257 100644
--- a/fern/generators.yml
+++ b/fern/generators.yml
@@ -36,7 +36,6 @@ groups:
         output:
           location: npm
           package-name: intercom-client
-          token: ${FERN_NPM_TOKEN}
         github:
           repository: intercom/intercom-node
           mode: pull-request