From cc0b89a2754d3883c4ad4d0fa97c5662c2a1a862 Mon Sep 17 00:00:00 2001
From: Andrea Bueide <abueide@twilio.com>
Date: Fri, 17 Jul 2026 15:13:40 -0500
Subject: [PATCH 1/2] ci: add a sandbox workflow to test Artifactory resolution
 on any branch

Testing whether a dependency change resolves cleanly through curated
Artifactory (catching curation-policy 403s like the ones fixed in
#1385/#1386) has meant triggering release.yml itself via
workflow_dispatch on a scratch branch - which works, but also arms the
publish job (harmless since it needs the production environment's
approval and never gets it, but not clean, and it's easy to forget
that job is sitting there).

This is a standalone workflow instead: manual-only, no should-release
gate, no publish job, nothing else it can accidentally trigger. Push
any candidate resolutions/yarn.lock change to a branch and run:

  gh workflow run test-artifactory-install.yml --ref <branch>

Deliberately doesn't cache yarn's dependency cache the way release.yml's
test job does - a warm cache can serve packages from GitHub's own cache
without ever making a real request to Artifactory, masking exactly the
kind of curation failure this exists to catch.
---
 .../workflows/test-artifactory-install.yml    | 28 +++++++++++++++++++
 1 file changed, 28 insertions(+)
 create mode 100644 .github/workflows/test-artifactory-install.yml

diff --git a/.github/workflows/test-artifactory-install.yml b/.github/workflows/test-artifactory-install.yml
new file mode 100644
index 000000000..5959bb2cb
--- /dev/null
+++ b/.github/workflows/test-artifactory-install.yml
@@ -0,0 +1,28 @@
+name: Test Artifactory Install (sandbox)
+# Manual-only, no publish step, no should-release gate - safe to run on any
+# branch to check whether `yarn install --immutable` resolves cleanly
+# through curated Artifactory (catches curation-policy 403s on specific
+# package versions) without touching master or arming a real release.
+# Usage: gh workflow run test-artifactory-install.yml --ref <branch>
+on:
+  workflow_dispatch: {}
+
+env:
+  HUSKY: 0
+  ARTIFACTORY_URL: ${{ vars.ARTIFACTORY_URL }}
+
+jobs:
+  test-install:
+    name: Test yarn install through curated Artifactory
+    runs-on: ubuntu-latest-large
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744  # v3
+      - name: Artifactory OIDC Auth
+        uses: ./.github/actions/artifactory-oidc
+      - uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610  # v3
+        with:
+          node-version: 20
+      - run: PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD=1 yarn install --immutable

From b9183ce8fb11bb806be68b798a89ef9424a3e35a Mon Sep 17 00:00:00 2001
From: Andrea Bueide <abueide@twilio.com>
Date: Fri, 17 Jul 2026 15:27:50 -0500
Subject: [PATCH 2/2] ci: test both Node 20 and 24 in the Artifactory sandbox
 workflow

release.yml's test job (Node 20) and publish job (Node 24) can resolve
different dependency trees - confirmed twice now, is-email and axios
each showed up curation-blocked under one Node version's install but
not the other's. Matrix this across both versions so the sandbox
actually covers what a real release run would hit.
---
 .github/workflows/test-artifactory-install.yml | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/test-artifactory-install.yml b/.github/workflows/test-artifactory-install.yml
index 5959bb2cb..cf9592baf 100644
--- a/.github/workflows/test-artifactory-install.yml
+++ b/.github/workflows/test-artifactory-install.yml
@@ -13,16 +13,25 @@ env:
 
 jobs:
   test-install:
-    name: Test yarn install through curated Artifactory
+    name: Test yarn install through curated Artifactory (Node ${{ matrix.node-version }})
     runs-on: ubuntu-latest-large
     permissions:
       contents: read
       id-token: write
+    strategy:
+      fail-fast: false
+      matrix:
+        # Different Node versions can resolve different optional/platform
+        # dependencies (confirmed: is-email and axios showed up blocked
+        # under one version's dependency tree but not the other's) -
+        # matches the two versions release.yml's test/publish jobs
+        # actually use.
+        node-version: [20, 24]
     steps:
       - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744  # v3
       - name: Artifactory OIDC Auth
         uses: ./.github/actions/artifactory-oidc
       - uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610  # v3
         with:
-          node-version: 20
+          node-version: ${{ matrix.node-version }}
       - run: PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD=1 yarn install --immutable