Re-enable the TypeScript SDK release workflow (#679)

Move ts-sdk.yml back into .github/workflows. The release job now runs
in the main environment, which is the only place FERN_TOKEN exists and
whose branch policy limits it to runs from main. Pin actions/checkout,
actions/setup-node and pnpm/action-setup to commits, declare read-only
permissions, stop persisting git credentials, serialise runs, and cap
the job at 30 minutes. The version input is validated as semver and
passed through an environment variable instead of being interpolated
into the shell.

Drop FERN_NPM_TOKEN from both the workflow and the ts-sdk generator
output. intercom-node publishes to npm through its own release
workflow, and Fern only opens a pull request there. Fern's config
loader fails on an undefined ${VAR}, so the two removals go together.

Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>

Author: levindixon

.github/workflows-disabled/ts-sdk.yml

@@ -0,0 +1,56 @@
+name: Release TypeScript SDK
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: "The version of the SDKs that you would like to release"
+        required: true
+        type: string
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}
+  cancel-in-progress: false
+
+jobs:
+  release:
+    name: Release
+    runs-on: ubuntu-latest
+    # FERN_TOKEN is an environment secret; only runs from main can reach it.
+    environment: main
+    timeout-minutes: 30
+    steps:
+      - name: Checkout repo
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Setup node
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 22
+          package-manager-cache: false
+
+      - name: Install pnpm
+        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
+
+      - name: Download Fern
+        run: pnpm add -g fern-api@5.65.3
+
+      - name: Validate version input
+        env:
+          VERSION: ${{ inputs.version }}
+        run: |
+          if ! [[ "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?$ ]]; then
+            echo "version must look like 7.0.5 or 7.0.5-beta.0, got: $VERSION"
+            exit 1
+          fi
+
+      - name: Release SDKs
+        env:
+          FERN_TOKEN: ${{ secrets.FERN_TOKEN }}
+          VERSION: ${{ inputs.version }}
+        run: fern generate --group ts-sdk --version "$VERSION" --log-level debug

.github/workflows/ts-sdk.yml

@@ -36,7 +36,6 @@ groups:
         output:
           location: npm
           package-name: intercom-client
-          token: ${FERN_NPM_TOKEN}
         github:
           repository: intercom/intercom-node
           mode: pull-request