FNA-1286: fix release workflow blocked by enterprise Actions policy

[jannoteelem]

Jira: https://twilio-engineering.atlassian.net/browse/FNA-1286

Background

This repo uses Changesets to manage versioning and npm publishing. The flow is:

1. A developer merges a PR that includes a `.changeset/*.md` file describing what changed and which packages bump (patch/minor/major).
2. When that lands on `main`, the `on-merge-main.yml` workflow runs and uses the `changesets/action` to either:
   • Open a "Version Packages" PR — bumps `package.json` versions and updates changelogs based on pending changesets, or
   • Publish to npm — if a Version Packages PR was already merged (changesets consumed), publishes the new versions.

What broke

After PR #555 was merged, the `Merge to main` workflow failed immediately with `startup_failure` — GitHub could not even start the workflow, zero jobs ran.

The error was:

The actions `changesets/action@v1`, `actions/checkout@v3`, `actions/setup-node@v3`, and `actions/checkout@v4` are not allowed in twilio-labs/serverless-toolkit because all actions must be from a repository owned by your enterprise or created by GitHub. All actions must also be pinned to a full-length commit SHA.

This is Twilio's enterprise GitHub Actions security policy, which requires:

1. Actions must be either owned by GitHub (`actions/*`) or the enterprise — no arbitrary third-party actions.
2. Even allowed actions must reference an exact commit SHA (e.g. `actions/checkout@abc123...`), not a floating tag like `@v3`, to prevent supply-chain attacks where a tag is silently moved to malicious code.

`startup_failure` runs cannot be re-run, and the workflow only triggers on push to `main`, so the release was completely stuck.

What each blocked action was doing

`changesets/action@v1` (third-party — fully blocked)

This is the main Changesets GitHub Action maintained by the Changesets project, not GitHub. It automated the entire release cycle:

• Detected whether any `.changeset/*.md` files exist on `main`.
• If yes: ran `changeset version` (bumps `package.json` files, writes changelogs, deletes consumed changeset files) and opened/updated a PR titled "Version Packages".
• If no pending changesets (i.e. the Version Packages PR was just merged): ran `changeset publish` to push all packages whose local version exceeds what's on npm.

Replacement: Rewrote this as a shell script in the workflow that does the same two-branch logic using the `npm run version-packages` and `npm run npm:publish` scripts that already exist in `package.json`, plus `gh pr create` to open the version PR.

`actions/checkout@v3` / `actions/checkout@v4` (GitHub-owned — allowed but not pinned)

These are GitHub's official action for checking out the repository code onto the runner. They are allowed by policy (GitHub-owned), but were referenced by floating tag (`@v3`, `@v4`) rather than a full commit SHA.

Fix: Pinned both to their exact commit SHAs:

• `actions/checkout@v3` → `actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744`
• `actions/checkout@v4` → `actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5`

`actions/setup-node@v3` (GitHub-owned — allowed but not pinned)

GitHub's official action for installing a specific Node.js version on the runner. Same issue as `checkout` — allowed by policy but used a floating tag.

Fix: Pinned to its exact commit SHA:

• `actions/setup-node@v3` → `actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610`

`lee-dohm/no-response@v0.5.0` in `noresponse.yml` (third-party — fully blocked)

This action automatically closes GitHub issues that have been labelled `question` but received no response from the author after 30 days. It runs on a daily cron schedule and on new issue comments.

It is a third-party action (not GitHub-owned) and therefore fully blocked by policy. Since this is a housekeeping feature with no impact on releases or CI correctness, the `noresponse.yml` workflow was disabled by replacing its trigger with `workflow_dispatch` (manual only, never fires automatically), preserving the file in case it is ever replaced with a compliant alternative.

Changes in this PR

File	Change
`.github/workflows/on-merge-main.yml`	Replace `changesets/action@v1` with shell script; pin `actions/checkout` and `actions/setup-node` to full SHAs
`.github/workflows/nodejs.yml`	Pin `actions/checkout` and `actions/setup-node` to full SHAs
`.github/workflows/noresponse.yml`	Disable automatic triggers (blocked third-party action)

Test plan

• Merge this PR to `main`
• Verify the "Merge to main" workflow starts successfully (no `startup_failure`)
• Verify a "chore: version packages" PR is opened for the pending node24 changeset from feat: add node24 CLI runtime support #555

[changeset-bot]

⚠️ No Changeset found

Latest commit: 41bad8d

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR