From 41bad8d23d207c7959ce645d8a0bc64af10a6d0f Mon Sep 17 00:00:00 2001
From: Janno Teelem <jteelem@twilio.com>
Date: Fri, 26 Jun 2026 17:36:59 +0300
Subject: [PATCH] FNA-1286: fix release workflow blocked by enterprise Actions
 policy

- Replace changesets/action@v1 (third-party, blocked) with equivalent shell commands
- Pin actions/checkout and actions/setup-node to full commit SHAs
- Disable noresponse.yml which uses blocked lee-dohm/no-response action
---
 .github/workflows/nodejs.yml        |  4 +--
 .github/workflows/noresponse.yml    |  6 +---
 .github/workflows/on-merge-main.yml | 47 ++++++++++++++++++++++++-----
 3 files changed, 42 insertions(+), 15 deletions(-)

diff --git a/.github/workflows/nodejs.yml b/.github/workflows/nodejs.yml
index 0a9f8fc4..f7c0e593 100644
--- a/.github/workflows/nodejs.yml
+++ b/.github/workflows/nodejs.yml
@@ -19,9 +19,9 @@ jobs:
         node-version: [ lts/-1, lts/*]
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
       - name: Use Node.js ${{ matrix.node-version }}
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3
         with:
           node-version: ${{ matrix.node-version }}
       - name: Update npm to 8.x
diff --git a/.github/workflows/noresponse.yml b/.github/workflows/noresponse.yml
index ebf19ed0..18b89b04 100644
--- a/.github/workflows/noresponse.yml
+++ b/.github/workflows/noresponse.yml
@@ -4,11 +4,7 @@ name: No Response
 # to work properly.
 # Details here: https://github.com/lee-dohm/no-response/blob/main/action.yml
 on:
-  issue_comment:
-    types: [created]
-  schedule:
-    # Schedule for 00:00 UTC every day
-    - cron: '0 0 * * *'
+  workflow_dispatch: # disabled: lee-dohm/no-response is blocked by enterprise policy
 
 jobs:
   noResponse:
diff --git a/.github/workflows/on-merge-main.yml b/.github/workflows/on-merge-main.yml
index c273edbe..dda39960 100644
--- a/.github/workflows/on-merge-main.yml
+++ b/.github/workflows/on-merge-main.yml
@@ -17,9 +17,12 @@ jobs:
 
     steps:
       - name: Checkout Repo
-        uses: actions/checkout@v3
+        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
+        with:
+          fetch-depth: 0
+          token: ${{ secrets.GITHUB_TOKEN }}
       - name: Setup Node.js 20
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3
         with:
           node-version: 20
       - name: Update npm to 10.x
@@ -35,12 +38,40 @@ jobs:
         run: |
           npm run clean
           npm run build
-      - name: "Create Pull Request or Publish to npm"
-        uses: changesets/action@v1
-        with:
-          version: npm run version-packages
-          publish: npm run npm:publish
-          commit: "chore: version packages"
+      - name: Check for changesets
+        id: changesets
+        run: |
+          if [ -n "$(find .changeset -name '*.md' -not -name 'README.md')" ]; then
+            echo "has_changesets=true" >> $GITHUB_OUTPUT
+          else
+            echo "has_changesets=false" >> $GITHUB_OUTPUT
+          fi
+      - name: Create Pull Request or Publish to npm
+        run: |
+          if [ "${{ steps.changesets.outputs.has_changesets }}" = "true" ]; then
+            # Changesets exist — open/update a version PR
+            npm run version-packages
+            git add -A
+            git status
+            if git diff --cached --quiet; then
+              echo "No version changes to commit"
+            else
+              git commit -m "chore: version packages"
+              BRANCH="changeset-release/main"
+              git checkout -b "$BRANCH" 2>/dev/null || git checkout "$BRANCH"
+              git push origin "$BRANCH" --force
+              gh pr create \
+                --title "chore: version packages" \
+                --body "This PR was opened by the release workflow. Merge to publish to npm." \
+                --base main \
+                --head "$BRANCH" \
+              || gh pr edit "$BRANCH" --title "chore: version packages"
+            fi
+          else
+            # No changesets — publish any packages whose version exceeds what is on npm
+            npm run npm:publish
+          fi
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}