build: replace pnpm with Bun - #746
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
@codex review Please review commit |
|
Codex Review: Didn't find any major issues. Delightful! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
There was a problem hiding this comment.
Pull request overview
This PR migrates the repository’s maintainer/CI/package-management workflow from pnpm to Bun while keeping the SDK/CLI runtime on Node.js and preserving release packaging/provenance behavior.
Changes:
- Replace pnpm invocations with Bun (
bun install,bun run,bun pm pack,bun audit) across scripts, CI workflows, Docker build, and docs. - Introduce Bun configuration (
bunfig.toml) and Bun lockfiles for the SDK, MCP app, and evals; remove pnpm workspace/lock artifacts where applicable. - Update safeguards/tests and plugin-source compatibility checks to recognize
bun.lockunder the existing lockfile size allowance.
Reviewed changes
Copilot reviewed 29 out of 35 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| sdk/typescript/tests-ts/skeleton.test.ts | Updates skeleton expectations from pnpm to Bun commands. |
| sdk/typescript/tests-ts/release-automation.test.ts | Adjusts release-workflow safeguard tests to expect Bun setup/commands. |
| sdk/typescript/TESTING.md | Updates SDK testing instructions to Bun install/run/pack commands and policy notes. |
| sdk/typescript/src/models.ts | Updates generated-file header to reference Bun model generation command. |
| sdk/typescript/scripts/smoke-package.mjs | Updates pack guidance in error message to bun pm pack. |
| sdk/typescript/scripts/generate-models.cjs | Updates generated header and “out of date” message to Bun command. |
| sdk/typescript/README.md | Updates source-checkout run instructions to Bun. |
| sdk/typescript/pnpm-workspace.yaml | Removes pnpm-only workspace configuration. |
| sdk/typescript/package.json | Pins packageManager to Bun, switches scripts to Bun, and adds trustedDependencies. |
| sdk/typescript/bunfig.toml | Adds Bun install/test configuration (isolated linker, minimumReleaseAge, test settings). |
| sdk/typescript/AGENTS.md | Updates agent guidance to use Bun for running scripts/tests. |
| plugins/codex-security/skills/triage-finding/evals/sastbench/README.md | Updates eval runner commands from pnpm to Bun. |
| plugins/codex-security/skills/triage-finding/evals/README.md | Updates eval setup/docs to Bun and documents standalone Bun workspace behavior. |
| plugins/codex-security/skills/triage-finding/evals/pnpm-workspace.yaml | Removes pnpm workspace config for evals. |
| plugins/codex-security/skills/triage-finding/evals/package.json | Migrates eval scripts to Bun; adds Bun packageManager, workspaces, overrides, trustedDependencies. |
| plugins/codex-security/skills/triage-finding/evals/bunfig.toml | Adds Bun install configuration for evals (isolated linker, minimumReleaseAge). |
| plugins/codex-security/mcp-app/TESTING.md | Updates MCP testing instructions to Bun. |
| plugins/codex-security/mcp-app/pnpm-workspace.yaml | Removes pnpm-only workspace configuration. |
| plugins/codex-security/mcp-app/pnpm-lock.yaml | Removes pnpm lockfile in favor of Bun lockfile. |
| plugins/codex-security/mcp-app/package.json | Pins packageManager to Bun, adds trustedDependencies. |
| plugins/codex-security/mcp-app/bunfig.toml | Adds Bun install configuration for MCP app (isolated linker, minimumReleaseAge). |
| plugins/codex-security/mcp-app/bun.lock | Adds Bun lockfile for MCP app dependencies. |
| examples/custom-validation/README.md | Updates example setup/build commands to Bun. |
| Dockerfile | Switches container build steps from corepack/pnpm to installing Bun and using Bun commands. |
| CONTRIBUTING.md | Updates contributor guidance for plugin build generation to Bun. |
| .ona/automations.yml | Updates Ona automation install/build/test commands from pnpm to Bun. |
| .github/workflows/test-quality.yml | Replaces pnpm setup/install/test steps with Bun setup, caching, and Bun commands. |
| .github/workflows/node-release.yml | Replaces pnpm-based install/audit/verify/pack steps with Bun equivalents and removes pnpm/corepack registry env vars. |
| .github/workflows/node-ci.yml | Replaces pnpm setup/install/audit/format/typecheck/pack/test steps with Bun equivalents and adds Bun caching. |
| .github/scripts/test_check_plugin_source_compatibility.py | Updates tests to treat bun.lock like other lockfiles for size rules. |
| .github/scripts/check_plugin_source_compatibility.py | Adds bun.lock to recognized dependency lockfile names for source-size checks. |
Files not reviewed (1)
- plugins/codex-security/mcp-app/pnpm-lock.yaml: Generated file
Suppressed comments (1)
.github/workflows/test-quality.yml:76
- The Bun cache key embeds the Bun version; if the job is updated to 1.3.14, the cache key should be updated too so caches don’t get shared across Bun versions.
- name: Cache Bun downloads
uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
with:
path: ~/.bun/install/cache
key: ${{ runner.os }}-${{ runner.arch }}-bun-1.3.13-${{ hashFiles('sdk/typescript/bun.lock', 'plugins/codex-security/mcp-app/bun.lock') }}
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
|
@codex review Please review the current head, |
|
Codex Review: Didn't find any major issues. Keep it up! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
Codex Review: Didn't find any major issues. Bravo. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
Summary
Replace pnpm with Bun for maintainer installs, scripts, CI, and packaging. The CLI and SDK still run on Node.js, and releases still publish the verified tarball with npm provenance.
Changes
maininto the branch.Testing
bun run test:ciwith coverage: 2,091 passed, 43 skipped, and four local transport failures. All four also reproduce on unchangedmain; the affected file passes all nine applicable tests on both branches using CI's temporary-directory setup.bun pm packand full installed-package checks passed on Node 22.13.0 and 24.15.0: 390 archive entries, executable launchers, imports/types, CLI, credential locking, MCP initialization, dashboard assets, and nested worker.Risk and rollout
Maintainers need Bun 1.3.14 and a supported Node.js version. Public CLI arguments, runtime support, dependency versions, and npm publication/provenance settings are unchanged. Release archives remain packed on Linux with executable-mode checks before publication. PR CI covers Linux, macOS, Windows, supported Node versions, and container validation.
Public disclosure review