feat: convert all GitHub Actions to Node20 JS with telemetry + post-cleanup

[fern-support]

Summary

Converts the 6 remaining composite actions (verify-token, resolve-cli, setup-cli, generate, sync-openapi, preview) to Node20 JS actions and adds post: cleanup phases + structured telemetry to all 9 actions in the repo.

Why: post: lets us run cleanup on action exit (success or failure), and JS actions give us structured logs we can scrape for telemetry/observability instead of relying on bash heuristics.

What changed

Shared utilities (packages/shared/)

• telemetry.ts — instrumentAction() wraps an action body and emits ::fern-telemetry::{json} events for start/end/error. runPostCleanup() emits a post event from the post phase with cumulative duration and a mainErrored flag.
• post-phase.ts — isPostPhase() / markMainPhaseStarted() so the same dist/index.js can serve both main and post.
• fern-cli.ts — resolveFernCli(version) returns {command, leadingArgs} for exec.exec, replacing the bash fern-cmd shell-string output.
• install-cli.ts — installFernCli(version) factored out for reuse by setup-cli and preview.
• getRequiredFernToken() — reads the fern-token input, throws the actionable verify-token-style error message if missing, and auto-masks via core.setSecret.

Actions converted from composite → JS

• verify-token, resolve-cli, setup-cli, generate, sync-openapi, preview (composite wrapper dropped — preview's existing JS body now handles install + run end-to-end).

Actions already JS, now instrumented

• example-action, upgrade, verify got telemetry + post: step.

pnpm-workspace.yaml

Now lists all 9 action dirs.

Behavior preserved

• Input/output names unchanged on every public action.
• resolve-cli fern-cmd output string format identical (npx --yes fern-api@<version> or bare fern).
• FERN_NO_VERSION_REDIRECTION env var still set when version != 'auto'.
• FERN_RUN_ID still inherited across steps.
• All customer-facing uses: fern-api/actions/<name>@… URLs unchanged.

Behavior changes (intentional)

• All actions now emit ::fern-telemetry:: log lines (structured JSON).
• All actions now run a post: step (no-op unless main phase started).
• verify-token and preview now auto-mask tokens via core.setSecret (was bash-only before, no masking).
• sync-openapi validates repository/sources in JS before invoking the CLI when update_from_source=false (previously the CLI received empty --repository "" and errored itself).
• generate no longer runs verify-token and resolve-cli as separate composite steps — equivalent logic is inlined. Lost the FERN_TOKEN is set. info log; friendly missing-token error message preserved.
• preview no longer pins to a specific setup-cli SHA — it calls the shared installFernCli helper directly. PR-comment posting now reads github-token as a proper input (defaulting to \${{ github.token }}) instead of process.env.GITHUB_TOKEN.

Tests

84 tests pass (was 26 before this PR).

New unit tests cover:

• getRequiredInput, getOptionalInput, getRequiredFernToken, parseRepository
• resolveFernCli (auto / inherit-with-fern / inherit-without-fern / pinned, env-var side effect, log line)
• installFernCli (missing npm, missing node, latest/auto/pinned, version-print env)
• instrumentAction (success path, error path, state saved)
• runPostCleanup (cumulative duration, mainErrored flag, no-op when state missing or unparseable)
• markMainPhaseStarted / isPostPhase
• buildGenerateArgs (every flag combo, stable ordering, empty-string-as-missing)
• buildPullSpecArgs / buildSyncSpecsArgs (required-field validation, flag ordering)
• normalizeFernVersion (auto → latest, undefined/empty → latest, pass-through)

Test plan

• pnpm install clean
• pnpm build produces dist/index.js for all 9 actions
• pnpm typecheck clean across all packages
• pnpm test — 84/84 passing
• pnpm check (biome) clean
• Smoke-tested verify-token and resolve-cli dist/index.js directly: main + post phases, success + error scenarios
• Run against a non-critical fern-* repo workflow before relying on this in production

---

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no potential bugs to report.

View in Devin Review to see 6 additional findings.