chore: migrate Cap tooling to Bun 1.4 - #2262
Merged
Merged
Conversation
![superagent-security[bot]](https://avatars.githubusercontent.com/in/3287076?s=60&v=4){kind=small}
| uses: actions/cache@v4 | ||
| with: | ||
| path: ${{ runner.temp }}/bun-cache | ||
| key: ${{ runner.os }}-${{ runner.arch }}-bun-1.4.0-${{ hashFiles('bun.lock') }} |
There was a problem hiding this comment.
P2: Scope the Bun dependency cache to trusted refs
Bun cache keys have no trusted-ref namespace and use a broad cross-ref restore prefix.
Separate PR and trusted-branch cache namespaces, or disable caching for untrusted PR jobs.
AI prompt
Check if this security scanner issue is valid. If so, understand the root cause and fix it. If appropriate, update or add tests. Keep the change focused and preserve intended behavior.
<file name=".github/actions/setup-js/action.yml">
<violation number="1" location=".github/actions/setup-js/action.yml:20">
<priority>P2</priority>
<title>Scope the Bun dependency cache to trusted refs</title>
<evidence>The cache key is `${{ runner.os }}-${{ runner.arch }}-bun-1.4.0-${{ hashFiles('bun.lock') }}` and the restore key is the broad `${{ runner.os }}-${{ runner.arch }}-bun-1.4.0-`. The key contains no branch or event trust boundary, so caches produced from untrusted PR execution can be eligible for reuse by other refs sharing the Bun prefix.</evidence>
<recommendation>Use separate cache namespaces for trusted default-branch/release jobs and untrusted pull-request jobs, or disable the cache for untrusted PRs. Keep restore keys equally scoped and verify that restored package-cache contents cannot override lockfile integrity checks.</recommendation>
</violation>
</file>
Member
Author
|
hey @greptileai, please re-review the PR |
Member
Author
|
hey @greptileai, please re-review the PR |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
Member
Author
|
hey @greptileai, please re-review the PR |
Member
Author
|
hey @greptileai, please re-review the PR |
Member
Author
|
hey @greptileai, please re-review the PR |
Member
Author
|
hey @greptileai, please re-review the PR |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Migrates workspace installs, scripts, CI, mobile EAS profiles, desktop packaging, Docker builds and contributor commands to Bun 1.4.0. Removes unused Storybook and web-cluster workspaces. Uses frozen installs, explicit native install hooks and Bun's hoisted linker while retaining existing dependency versions and Node runtimes.
Removes the old cluster deployment tooling, staging infrastructure definition, internal Loom RPC endpoint and its environment/schema wiring and unused generated resource bindings. Current dashboard, mobile and agent Loom imports continue through Vercel Workflows. Normal Effect RPC, database/storage services, media-server processing and OpenPanel remain intact. No production deployment or provider settings were changed.
Retains root React 19.2.0 anchors for Expo alongside web/extension React 19.2.4, consistent Vitest React resolution, the eight web compatibility suites in CI, FFmpeg tracing, desktop argument forwarding and signing retries.
Validation:
Earlier migration validation passed desktop, mobile and extension tests; desktop frontend/extension builds; Expo Doctor (19/19); iOS Metro/Hermes export; Linux arm64 web Docker build and FFmpeg/sharp execution; affected Rust checks; Tauri resolution and FFmpeg route tracing. Current-head CI and Vercel results are tracked on this PR. Signed native releases, EAS cloud builds and installed-app recording/export smoke tests remain unverified.
Greptile Summary
This PR migrates workspace tooling and automation from pnpm to Bun 1.4.0, updates contributor and packaging commands, removes unused Storybook and web-cluster infrastructure, and retains the active Loom import path through Vercel Workflows. Since the previous review, it corrects two web-test fixtures:
Confidence Score: 5/5
The PR appears safe to merge, with no outstanding correctness or repository-rule violations identified in the changes since the previous review.
The two recent test updates match current production data shapes and configuration, the prior compatibility-test finding is resolved, and no new actionable failures remain.
Important Files Changed
webMP4source to the shared video fixture so it matches the current processing workflow contract.Reviews (7): Last reviewed commit: "test: refresh video and Slack fixtures" | Re-trigger Greptile