mirrors/bun
0
0 Fork 0
mirror of https://github.com/oven-sh/bun.git synced 2026-10-25 21:40:30 +08:00
Code Activity

ci: harden GitHub Actions workflows (#36778)

Browse Source 
### What does this PR do?

Tightens the GitHub Actions workflows against the credential-theft
patterns behind this year's action supply-chain incidents (persisted
checkout tokens, floating tags, `${{ }}` in shell), and deletes
workflows that have been dead for a year or more — one of which
referenced the compromised `actions-cool/issues-helper@v3`.

| Change | Scope |
|---|---|
| `actions/checkout` → v7.0.1 SHA, `persist-credentials: false` | all 30
checkouts; homebrew tap push now passes its token explicitly |
| top-level `permissions: contents: read` | 27 workflows that had none
(job-level grants unchanged) |
| `${{ inputs/steps/env.* }}` moved from `run:` into `env:` | setup-bun
action, release, vscode-release, update-sqlite3, auto-assign-types,
format/clippy/miri |
| third-party actions dropped | `JS-DevTools/npm-publish` → `npm
publish`; `git-auto-commit-action` → plain git; `oven-sh/setup-bun`
v1/v2 → in-repo `setup-bun` |
| triage jobs | `anthropics/claude-code-action/base-action` v1.0.183
(old mirror stopped tagging), model `claude-opus-5` |
| Bun used by CI jobs | 1.3.14 |
| `release.yml` `is-latest` | read boolean `inputs.is-latest`;
`github.event.inputs.is-latest` is the string `"false"` (truthy), so
manual dispatches always published as latest |
| new `dependabot.yml` | github-actions, weekly, 7-day cooldown |

| Deleted | Why |
|---|---|
| `labeled.yml.disabled` | disabled Nov 2025; used
`actions-cool/issues-helper@v3` (compromised May 2026 — never ran here)
|
| `comment-lint.yml.disabled` | disabled Nov 2025; listened for a
workflow that no longer exists |
| `update-root-certs.yml` | disabled in the Actions UI since Aug 2025;
every run was `startup_failure` |
| `test-bump.yml`, `actions/bump`, release `bump` job |
`scripts/bump.ts` was removed in 2024 |

### How did you verify your code works?

`zizmor .github`: 54 → 5 findings; the remainder are three
`pull_request_target` workflows that never check out PR code and a
`GITHUB_PATH` append in setup-bun. All YAML parses. PR-triggered
workflows (lint/format/clippy/bun-types/packages-ci) exercise the
checkout/permissions/setup-bun changes on this PR.

Not exercisable until the next release: the `npm-types` publish step and
the homebrew tap push in `release.yml`.
This commit is contained in:
Jarred Sumner authored and GitHub committed 2026-08-03 00:56:16 -07:00
1 parent 1dcb0bfe36
commit 074656dd73
35 files changed
+243 -641
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

.github/actions/bump/action.yml
-42
View File
@@ -1,42 +0,0 @@
name: Bump version
description: Bump the version of Bun
inputs:
version:
description: The most recent version of Bun.
required: true
type: string
token:
description: The GitHub token to use for creating a pull request.
required: true
type: string
default: ${{ github.token }}
runs:
using: composite
steps:
- name: Run Bump
shell: bash
id: bump
run: |
set -euo pipefail
MESSAGE=$(bun ./scripts/bump.ts patch --last-version=${{ inputs.version }})
LATEST=$(cat LATEST)
echo "version=$LATEST" >> $GITHUB_OUTPUT
echo "message=$MESSAGE" >> $GITHUB_OUTPUT
- name: Create Pull Request
uses: peter-evans/create-pull-request@22a9089034f40e5a961c8808d113e2c98fb63676 # v7
with:
add-paths: |
LATEST
token: ${{ inputs.token }}
commit-message: Bump version to ${{ steps.bump.outputs.version }}
title: Bump to ${{ steps.bump.outputs.version }}
delete-branch: true
branch: github-actions/bump-version-${{ steps.bump.outputs.version }}--${{ github.run_id }}
body: |
## What does this PR do?
${{ steps.bump.outputs.message }}
Auto-bumped by [this workflow](https://github.com/oven-sh/bun/actions/workflows/release.yml)
.github/actions/setup-bun/action.yml
+14 -10
View File
@@ -23,6 +23,10 @@ runs:
steps:
- name: Setup Bun
shell: bash
env:
BUN_VERSION: ${{ inputs.bun-version }}
BUN_BASELINE: ${{ inputs.baseline }}
BUN_DOWNLOAD_URL: ${{ inputs.download-url }}
run: |
case "$(uname -s)" in
Linux*) os=linux;;
@@ -33,19 +37,19 @@ runs:
arm64 | aarch64) arch=aarch64;;
*) arch=x64;;
esac
case "${{ inputs.baseline }}" in
case "$BUN_BASELINE" in
true | 1) target="bun-${os}-${arch}-baseline";;
*) target="bun-${os}-${arch}";;
esac
case "${{ inputs.bun-version }}" in
case "$BUN_VERSION" in
latest) release="latest";;
canary) release="canary";;
*) release="bun-v${{ inputs.bun-version }}";;
*) release="bun-v${BUN_VERSION}";;
esac
curl -LO "${{ inputs.download-url }}/${release}/${target}.zip" --retry 5
unzip ${target}.zip
mkdir -p ${{ runner.temp }}/.bun/bin
mv ${target}/bun* ${{ runner.temp }}/.bun/bin/
chmod +x ${{ runner.temp }}/.bun/bin/*
ln -fs ${{ runner.temp }}/.bun/bin/bun ${{ runner.temp }}/.bun/bin/bunx
echo "${{ runner.temp }}/.bun/bin" >> ${GITHUB_PATH}
curl -LO "${BUN_DOWNLOAD_URL}/${release}/${target}.zip" --retry 5
unzip "${target}.zip"
mkdir -p "$RUNNER_TEMP/.bun/bin"
mv "${target}"/bun* "$RUNNER_TEMP/.bun/bin/"
chmod +x "$RUNNER_TEMP"/.bun/bin/*
ln -fs "$RUNNER_TEMP/.bun/bin/bun" "$RUNNER_TEMP/.bun/bin/bunx"
echo "$RUNNER_TEMP/.bun/bin" >> "$GITHUB_PATH"
.github/dependabot.yml
+13
View File
@@ -0,0 +1,13 @@
version: 2
updates:
- package-ecosystem: github-actions
directories:
- /
- /.github/actions/*
schedule:
interval: weekly
cooldown:
default-days: 7
groups:
actions:
patterns: ["*"]
.github/workflows/auto-assign-types.yml
+5 -1
View File
@@ -1,5 +1,8 @@
name: Auto Assign Types Issues
permissions:
contents: read
on:
issues:
types: [labeled]
@@ -15,5 +18,6 @@ jobs:
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
GH_REPO: ${{ github.repository }}
ISSUE: ${{ github.event.issue.number }}
run: |
gh issue edit ${{ github.event.issue.number }} --add-assignee alii
gh issue edit "$ISSUE" --add-assignee alii
.github/workflows/auto-close-duplicates.yml
+6 -1
View File
@@ -1,4 +1,7 @@
name: Auto-close duplicate issues
permissions:
contents: read
on:
schedule:
- cron: "0 9 * * *"
@@ -17,7 +20,9 @@ jobs:
steps:
- name: Checkout repository
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- name: Setup Bun
uses: ./.github/actions/setup-bun
.github/workflows/auto-label-claude-prs.yml
+3
View File
@@ -1,5 +1,8 @@
name: Auto-label Claude PRs
permissions:
contents: read
on:
pull_request:
types: [opened]
.github/workflows/bun-types.yml
+3 -1
View File
@@ -30,7 +30,9 @@ jobs:
runs-on: ubuntu-latest
timeout-minutes: 30
steps:
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- name: Setup Bun
uses: ./.github/actions/setup-bun
with:
.github/workflows/claude-dedupe-issues.yml
+8 -3
View File
@@ -1,4 +1,7 @@
name: Claude Issue Dedupe
permissions:
contents: read
on:
issues:
types: [opened]
@@ -22,12 +25,14 @@ jobs:
steps:
- name: Checkout repository
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- name: Run Claude Code slash command
uses: anthropics/claude-code-base-action@98d41f9809750c4c96f2cd285746ecef889f14bc
uses: anthropics/claude-code-action/base-action@be7b93b1907a4abad570368f3c74b6fe3807510b # v1.0.183
env:
ANTHROPIC_MODEL: claude-opus-4-6[1m]
ANTHROPIC_MODEL: claude-opus-5[1m]
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
with:
prompt: "/dedupe ${{ github.repository }}/issues/${{ github.event.issue.number || inputs.issue_number }}"
.github/workflows/claude-find-issues-for-pr.yml
+10 -5
View File
@@ -1,4 +1,7 @@
name: Claude Find Issues for PR
permissions:
contents: read
on:
pull_request:
types: [opened]
@@ -23,12 +26,14 @@ jobs:
steps:
- name: Checkout repository
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- name: Find issues this PR may fix
uses: anthropics/claude-code-base-action@98d41f9809750c4c96f2cd285746ecef889f14bc
uses: anthropics/claude-code-action/base-action@be7b93b1907a4abad570368f3c74b6fe3807510b # v1.0.183
env:
ANTHROPIC_MODEL: claude-opus-4-6[1m]
ANTHROPIC_MODEL: claude-opus-5[1m]
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
with:
prompt: "/find-issues ${{ github.repository }}/pull/${{ github.event.pull_request.number || inputs.pr_number }}"
@@ -36,9 +41,9 @@ jobs:
- name: Find duplicate PRs
if: always()
uses: anthropics/claude-code-base-action@98d41f9809750c4c96f2cd285746ecef889f14bc
uses: anthropics/claude-code-action/base-action@be7b93b1907a4abad570368f3c74b6fe3807510b # v1.0.183
env:
ANTHROPIC_MODEL: claude-opus-4-6[1m]
ANTHROPIC_MODEL: claude-opus-5[1m]
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
with:
prompt: "/find-duplicate-prs ${{ github.repository }}/pull/${{ github.event.pull_request.number || inputs.pr_number }}"
.github/workflows/clippy.yml
+4 -4
View File
@@ -23,7 +23,7 @@ on:
merge_group:
env:
BUN_VERSION: "1.3.2"
BUN_VERSION: "1.3.14"
LLVM_VERSION_MAJOR: "21"
# Pin the toolchain explicitly so rustup ignores rust-toolchain.toml's
# `targets` list (11 cross triples ≈ 450 MB of prebuilt std we don't need
@@ -39,7 +39,7 @@ jobs:
cancel-in-progress: true
steps:
- name: Checkout
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
@@ -53,9 +53,9 @@ jobs:
# (configure resolves cfg.cc/cxx even though we won't compile C++).
run: |
wget -qO- https://apt.llvm.org/llvm-snapshot.gpg.key | sudo tee /etc/apt/trusted.gpg.d/apt.llvm.org.asc > /dev/null
echo "deb http://apt.llvm.org/$(lsb_release -cs)/ llvm-toolchain-$(lsb_release -cs)-${{ env.LLVM_VERSION_MAJOR }} main" | sudo tee /etc/apt/sources.list.d/llvm.list > /dev/null
echo "deb http://apt.llvm.org/$(lsb_release -cs)/ llvm-toolchain-$(lsb_release -cs)-${LLVM_VERSION_MAJOR} main" | sudo tee /etc/apt/sources.list.d/llvm.list > /dev/null
sudo apt-get update -qq
sudo apt-get install -y -qq --no-install-recommends cmake ninja-build clang-${{ env.LLVM_VERSION_MAJOR }} lld-${{ env.LLVM_VERSION_MAJOR }} llvm-${{ env.LLVM_VERSION_MAJOR }}
sudo apt-get install -y -qq --no-install-recommends cmake ninja-build clang-${LLVM_VERSION_MAJOR} lld-${LLVM_VERSION_MAJOR} llvm-${LLVM_VERSION_MAJOR}
- name: Setup Rust
run: |
.github/workflows/close-stale-robobun-prs.yml
+3
View File
@@ -1,4 +1,7 @@
name: Close stale robobun PRs
permissions:
contents: read
on:
schedule:
- cron: "30 0 * * *"
.github/workflows/comment-lint.yml.disabled
-85
View File
@@ -1,85 +0,0 @@
name: C++ Linter comment
permissions:
actions: read
pull-requests: write
on:
workflow_run:
workflows:
- lint-cpp
types:
- completed
jobs:
comment-lint:
if: ${{ github.repository_owner == 'oven-sh' }}
name: Comment
runs-on: ubuntu-latest
steps:
- name: Download Comment
uses: actions/download-artifact@v4
with:
name: format.log
github-token: ${{ github.token }}
run-id: ${{ github.event.workflow_run.id }}
- name: PR Number
uses: actions/download-artifact@v4
with:
name: pr-number.txt
github-token: ${{ github.token }}
run-id: ${{ github.event.workflow_run.id }}
- name: Did Fail
uses: actions/download-artifact@v4
with:
name: did_fail.txt
github-token: ${{ github.token }}
run-id: ${{ github.event.workflow_run.id }}
- name: Setup Environment
id: env
shell: bash
run: |
# Copy to outputs
echo "pr-number=$(cat pr-number.txt)" >> $GITHUB_OUTPUT
{
echo 'text_output<<EOF'
cat format.log
echo EOF
} >> "$GITHUB_OUTPUT"
echo "did_fail=$(cat did_fail.txt)" >> $GITHUB_OUTPUT
- name: Find Comment
id: comment
uses: peter-evans/find-comment@v3
with:
issue-number: ${{ steps.env.outputs.pr-number }}
comment-author: github-actions[bot]
body-includes: <!-- generated-comment lint-cpp-workflow=${{ github.workflow }} -->
- name: Update Comment
uses: peter-evans/create-or-update-comment@v4
if: steps.env.outputs.did_fail != '0'
with:
comment-id: ${{ steps.comment.outputs.comment-id }}
issue-number: ${{ steps.env.outputs.pr-number }}
body: |
@${{ github.actor }}, `clang-tidy` had something to share with you about your code:
```cpp
${{ steps.env.outputs.text_output }}
```
Commit: ${{ github.event.workflow_run.head_sha || github.sha }}
<!-- generated-comment lint-cpp-workflow=${{ github.workflow }} -->
edit-mode: replace
- name: Update Previous Comment
uses: peter-evans/create-or-update-comment@v4
if: steps.env.outputs.did_fail == '0' && steps.comment.outputs.comment-id != ''
with:
comment-id: ${{ steps.comment.outputs.comment-id }}
issue-number: ${{ steps.env.outputs.pr-number }}
body: |
clang-tidy nits are fixed! Thank you.
<!-- generated-comment lint-cpp-workflow=${{ github.workflow }} -->
edit-mode: replace
.github/workflows/format.yml
+9 -7
View File
@@ -9,7 +9,7 @@ on:
pull_request:
merge_group:
env:
BUN_VERSION: "1.3.2"
BUN_VERSION: "1.3.14"
LLVM_VERSION: "21.1.8"
LLVM_VERSION_MAJOR: "21"
@@ -22,7 +22,9 @@ jobs:
cancel-in-progress: true
steps:
- name: Checkout
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- name: Configure Git
run: |
git config --global core.autocrlf true
@@ -54,13 +56,13 @@ jobs:
# Start clang-format installation and formatting in background with prefixed output
echo "::group::Clang-format"
(
echo "[clang-format] Installing clang-format-${{ env.LLVM_VERSION_MAJOR }}..."
echo "[clang-format] Installing clang-format-${LLVM_VERSION_MAJOR}..."
wget -qO- https://apt.llvm.org/llvm-snapshot.gpg.key | sudo tee /etc/apt/trusted.gpg.d/apt.llvm.org.asc > /dev/null
echo "deb http://apt.llvm.org/$(lsb_release -cs)/ llvm-toolchain-$(lsb_release -cs)-${{ env.LLVM_VERSION_MAJOR }} main" | sudo tee /etc/apt/sources.list.d/llvm.list > /dev/null
echo "deb http://apt.llvm.org/$(lsb_release -cs)/ llvm-toolchain-$(lsb_release -cs)-${LLVM_VERSION_MAJOR} main" | sudo tee /etc/apt/sources.list.d/llvm.list > /dev/null
sudo apt-get update -qq
sudo apt-get install -y -qq --no-install-recommends --no-install-suggests -o=Dpkg::Use-Pty=0 clang-format-${{ env.LLVM_VERSION_MAJOR }}
sudo apt-get install -y -qq --no-install-recommends --no-install-suggests -o=Dpkg::Use-Pty=0 clang-format-${LLVM_VERSION_MAJOR}
echo "[clang-format] Running clang-format..."
LLVM_VERSION_MAJOR=${{ env.LLVM_VERSION_MAJOR }} ./scripts/run-clang-format.sh format 2>&1 | sed 's/^/[clang-format] /'
./scripts/run-clang-format.sh format 2>&1 | sed 's/^/[clang-format] /'
) &
CLANG_PID=$!
@@ -113,4 +115,4 @@ jobs:
# CI rather than as a confusing behaviour diff later.
run: |
bun run codegen:verify
- uses: autofix-ci/action@635ffb0c9798bd160680f18fd73371e355b85f27
- uses: autofix-ci/action@635ffb0c9798bd160680f18fd73371e355b85f27 # v1.3.2
.github/workflows/freebsd-smoke.yml
+5 -1
View File
@@ -6,6 +6,9 @@ name: FreeBSD smoke test
#
# Triggered manually with a BuildKite artifact URL.
permissions:
contents: read
on:
workflow_dispatch:
inputs:
@@ -23,8 +26,9 @@ jobs:
matrix:
version: ['14.3']
steps:
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
sparse-checkout: |
test/js/bun
test/harness.ts
.github/workflows/labeled.yml.disabled
-278
View File
@@ -1,278 +0,0 @@
name: Issue Labeled
env:
BUN_VERSION: 1.1.44
on:
issues:
types: [labeled]
pull_request_target:
types: [labeled, opened, reopened, synchronize, unlabeled]
jobs:
# on-bug:
# runs-on: ubuntu-latest
# if: github.event.label.name == 'bug' || github.event.label.name == 'crash'
# permissions:
# issues: write
# steps:
# - name: Checkout
# uses: actions/checkout@v4
# with:
# sparse-checkout: |
# scripts
# .github
# CMakeLists.txt
# - name: Setup Bun
# uses: ./.github/actions/setup-bun
# with:
# bun-version: ${{ env.BUN_VERSION }}
# - name: "categorize bug"
# id: add-labels
# env:
# GITHUB_ISSUE_BODY: ${{ github.event.issue.body }}
# GITHUB_ISSUE_TITLE: ${{ github.event.issue.title }}
# ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
# shell: bash
# run: |
# echo '{"dependencies": { "@anthropic-ai/sdk": "latest" }}' > scripts/package.json && bun install --cwd=./scripts
# LABELS=$(bun scripts/label-issue.ts)
# echo "labels=$LABELS" >> $GITHUB_OUTPUT
# - name: Add labels
# uses: actions-cool/issues-helper@v3
# if: steps.add-labels.outputs.labels != ''
# with:
# actions: "add-labels"
# token: ${{ secrets.GITHUB_TOKEN }}
# issue-number: ${{ github.event.issue.number }}
# labels: ${{ steps.add-labels.outputs.labels }}
on-slop:
runs-on: ubuntu-latest
if: github.event_name == 'pull_request_target' && contains(github.event.pull_request.labels.*.name, 'slop')
permissions:
issues: write
pull-requests: write
contents: write
steps:
- name: Update PR title and body for slop and close
uses: actions/github-script@v7
with:
script: |
const pr = await github.rest.pulls.get({
owner: context.repo.owner,
repo: context.repo.repo,
pull_number: context.issue.number
});
await github.rest.pulls.update({
owner: context.repo.owner,
repo: context.repo.repo,
pull_number: context.issue.number,
title: 'ai slop',
body: 'This PR has been marked as AI slop and the description has been updated to avoid confusion or misleading reviewers.\n\nMany AI PRs are fine, but sometimes they submit a PR too early, fail to test if the problem is real, fail to reproduce the problem, or fail to test that the problem is fixed. If you think this PR is not AI slop, please leave a comment.',
state: 'closed'
});
// Delete the branch if it's from a fork or if it's not a protected branch
try {
await github.rest.git.deleteRef({
owner: context.repo.owner,
repo: context.repo.repo,
ref: `heads/${pr.data.head.ref}`
});
} catch (error) {
console.log('Could not delete branch:', error.message);
}
on-labeled:
runs-on: ubuntu-latest
if: github.event_name == 'issues' && (github.event.label.name == 'crash' || github.event.label.name == 'needs repro')
permissions:
issues: write
steps:
- name: Checkout
uses: actions/checkout@v4
with:
sparse-checkout: |
scripts
.github
CMakeLists.txt
- name: Setup Bun
uses: ./.github/actions/setup-bun
with:
bun-version: ${{ env.BUN_VERSION }}
- name: "add platform and command label"
id: add-labels
if: github.event.label.name == 'crash'
env:
GITHUB_ISSUE_BODY: ${{ github.event.issue.body }}
GITHUB_ISSUE_TITLE: ${{ github.event.issue.title }}
GITHUB_ISSUE_NUMBER: ${{ github.event.issue.number }}
shell: bash
run: |
LABELS=$(bun scripts/read-issue.ts)
bun scripts/is-outdated.ts
# Check for patterns that should close the issue
CLOSE_ACTION=$(bun scripts/handle-crash-patterns.ts)
echo "close-action=$CLOSE_ACTION" >> $GITHUB_OUTPUT
if [[ -f "is-outdated.txt" ]]; then
echo "is-outdated=true" >> $GITHUB_OUTPUT
fi
if [[ -f "outdated.txt" ]]; then
echo "outdated=$(cat outdated.txt)" >> $GITHUB_OUTPUT
fi
if [[ -f "is-standalone.txt" ]]; then
echo "is-standalone=true" >> $GITHUB_OUTPUT
fi
if [[ -f "is-very-outdated.txt" ]]; then
echo "is-very-outdated=true" >> $GITHUB_OUTPUT
LABELS="$LABELS,old-version"
else
echo "is-very-outdated=false" >> $GITHUB_OUTPUT
fi
echo "latest=$(cat LATEST)" >> $GITHUB_OUTPUT
echo "labels=$LABELS" >> $GITHUB_OUTPUT
rm -rf is-outdated.txt outdated.txt latest.txt is-very-outdated.txt is-standalone.txt
- name: Close issue if pattern detected
if: github.event.label.name == 'crash' && fromJson(steps.add-labels.outputs.close-action).close == true
uses: actions/github-script@v7
with:
script: |
const closeAction = ${{ fromJson(steps.add-labels.outputs.close-action) }};
// Comment with the reason
await github.rest.issues.createComment({
owner: context.repo.owner,
repo: context.repo.repo,
issue_number: context.issue.number,
body: closeAction.comment
});
// Close the issue
await github.rest.issues.update({
owner: context.repo.owner,
repo: context.repo.repo,
issue_number: context.issue.number,
state: 'closed',
state_reason: closeAction.reason
});
- name: Generate comment text with Sentry Link
if: github.event.label.name == 'crash' && fromJson(steps.add-labels.outputs.close-action).close != true
# ignore if fail
continue-on-error: true
id: generate-comment-text
env:
GITHUB_ISSUE_BODY: ${{ github.event.issue.body }}
SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_EVENTS_SECRET }}
shell: bash
run: |
bun scripts/associate-issue-with-sentry.ts
if [[ -f "sentry-link.txt" ]]; then
echo "sentry-link=$(cat sentry-link.txt)" >> $GITHUB_OUTPUT
fi
if [[ -f "sentry-id.txt" ]]; then
echo "sentry-id=$(cat sentry-id.txt)" >> $GITHUB_OUTPUT
fi
- name: Remove old labels
uses: actions-cool/issues-helper@v3
if: github.event.label.name == 'crash' && steps.add-labels.outputs.is-very-outdated == 'false'
with:
actions: "remove-labels"
token: ${{ secrets.GITHUB_TOKEN }}
issue-number: ${{ github.event.issue.number }}
labels: old-version
- name: Add labels
uses: actions-cool/issues-helper@v3
if: github.event.label.name == 'crash'
with:
actions: "add-labels"
token: ${{ secrets.GITHUB_TOKEN }}
issue-number: ${{ github.event.issue.number }}
labels: ${{ steps.add-labels.outputs.labels }}
- name: Comment outdated (standalone executable)
if: steps.add-labels.outputs.is-outdated == 'true' && steps.add-labels.outputs.is-standalone == 'true' && github.event.label.name == 'crash' && steps.generate-comment-text.outputs.sentry-link == ''
uses: actions-cool/issues-helper@v3
with:
actions: "create-comment"
token: ${{ secrets.GITHUB_TOKEN }}
issue-number: ${{ github.event.issue.number }}
body: |
@${{ github.event.issue.user.login }}, the latest version of Bun is v${{ steps.add-labels.outputs.latest }}, but the standalone executable is running Bun v${{ steps.add-labels.outputs.outdated }}. When the CLI using Bun's single-file executable next updates it might be fixed.
- name: Comment outdated
if: steps.add-labels.outputs.is-outdated == 'true' && steps.add-labels.outputs.is-standalone != 'true' && github.event.label.name == 'crash' && steps.generate-comment-text.outputs.sentry-link == ''
uses: actions-cool/issues-helper@v3
with:
actions: "create-comment"
token: ${{ secrets.GITHUB_TOKEN }}
issue-number: ${{ github.event.issue.number }}
body: |
@${{ github.event.issue.user.login }}, the latest version of Bun is v${{ steps.add-labels.outputs.latest }}, but this crash was reported on Bun v${{ steps.add-labels.outputs.outdated }}.
Are you able to reproduce this crash on the latest version of Bun?
```sh
bun upgrade
```
- name: Comment with Sentry Link and outdated version (standalone executable)
if: steps.generate-comment-text.outputs.sentry-link != '' && github.event.label.name == 'crash' && steps.add-labels.outputs.is-outdated == 'true' && steps.add-labels.outputs.is-standalone == 'true'
uses: actions-cool/issues-helper@v3
with:
actions: "create-comment"
token: ${{ secrets.GITHUB_TOKEN }}
issue-number: ${{ github.event.issue.number }}
body: |
@${{ github.event.issue.user.login }}, thank you for reporting this crash. The latest version of Bun is v${{ steps.add-labels.outputs.latest }}, but the standalone executable is running Bun v${{ steps.add-labels.outputs.outdated }}. When the CLI using Bun's single-file executable next updates it might be fixed.
For Bun's internal tracking, this issue is [${{ steps.generate-comment-text.outputs.sentry-id }}](${{ steps.generate-comment-text.outputs.sentry-link }}).
<!-- sentry-id: ${{ steps.generate-comment-text.outputs.sentry-id }} -->
<!-- sentry-link: ${{ steps.generate-comment-text.outputs.sentry-link }} -->
- name: Comment with Sentry Link and outdated version
if: steps.generate-comment-text.outputs.sentry-link != '' && github.event.label.name == 'crash' && steps.add-labels.outputs.is-outdated == 'true' && steps.add-labels.outputs.is-standalone != 'true'
uses: actions-cool/issues-helper@v3
with:
actions: "create-comment"
token: ${{ secrets.GITHUB_TOKEN }}
issue-number: ${{ github.event.issue.number }}
body: |
@${{ github.event.issue.user.login }}, thank you for reporting this crash. The latest version of Bun is v${{ steps.add-labels.outputs.latest }}, but this crash was reported on Bun v${{ steps.add-labels.outputs.outdated }}.
Are you able to reproduce this crash on the latest version of Bun?
```sh
bun upgrade
```
For Bun's internal tracking, this issue is [${{ steps.generate-comment-text.outputs.sentry-id }}](${{ steps.generate-comment-text.outputs.sentry-link }}).
<!-- sentry-id: ${{ steps.generate-comment-text.outputs.sentry-id }} -->
<!-- sentry-link: ${{ steps.generate-comment-text.outputs.sentry-link }} -->
- name: Comment with Sentry Link
if: steps.generate-comment-text.outputs.sentry-link != '' && github.event.label.name == 'crash' && steps.add-labels.outputs.is-outdated != 'true'
uses: actions-cool/issues-helper@v3
with:
actions: "create-comment"
token: ${{ secrets.GITHUB_TOKEN }}
issue-number: ${{ github.event.issue.number }}
body: |
Thank you for reporting this crash.
For Bun's internal tracking, this issue is [${{ steps.generate-comment-text.outputs.sentry-id }}](${{ steps.generate-comment-text.outputs.sentry-link }}).
<!-- sentry-id: ${{ steps.generate-comment-text.outputs.sentry-id }} -->
<!-- sentry-link: ${{ steps.generate-comment-text.outputs.sentry-link }} -->
- name: Comment needs repro
if: github.event.label.name == 'needs repro'
uses: actions-cool/issues-helper@v3
with:
actions: "create-comment"
token: ${{ secrets.GITHUB_TOKEN }}
issue-number: ${{ github.event.issue.number }}
body: |
Hello @${{ github.event.issue.user.login }}. Please provide a [minimal reproduction](https://stackoverflow.com/help/minimal-reproducible-example) using a GitHub repository, [Replit](https://replit.com/@replit/Bun), [CodeSandbox](https://codesandbox.io/templates/bun), or provide a bulleted list of commands to run that reproduce this issue. Issues marked with `needs repro` will be closed if they have no activity within 3 days.
.github/workflows/lint.yml
+7 -2
View File
@@ -1,18 +1,23 @@
name: Lint
permissions:
contents: read
on:
pull_request:
workflow_dispatch:
env:
BUN_VERSION: "1.2.10"
BUN_VERSION: "1.3.14"
jobs:
lint-js:
name: "Lint JavaScript"
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- name: Setup Bun
uses: ./.github/actions/setup-bun
with:
.github/workflows/miri.yml
+4 -4
View File
@@ -33,7 +33,7 @@ on:
merge_group:
env:
BUN_VERSION: "1.3.2"
BUN_VERSION: "1.3.14"
LLVM_VERSION_MAJOR: "21"
# Pin so rustup ignores rust-toolchain.toml's `targets` list (11 cross
# triples ≈ 450 MB we don't need). Keep in sync with `channel` there.
@@ -48,7 +48,7 @@ jobs:
cancel-in-progress: true
steps:
- name: Checkout
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
@@ -63,9 +63,9 @@ jobs:
# build_options.rs).
run: |
wget -qO- https://apt.llvm.org/llvm-snapshot.gpg.key | sudo tee /etc/apt/trusted.gpg.d/apt.llvm.org.asc > /dev/null
echo "deb http://apt.llvm.org/$(lsb_release -cs)/ llvm-toolchain-$(lsb_release -cs)-${{ env.LLVM_VERSION_MAJOR }} main" | sudo tee /etc/apt/sources.list.d/llvm.list > /dev/null
echo "deb http://apt.llvm.org/$(lsb_release -cs)/ llvm-toolchain-$(lsb_release -cs)-${LLVM_VERSION_MAJOR} main" | sudo tee /etc/apt/sources.list.d/llvm.list > /dev/null
sudo apt-get update -qq
sudo apt-get install -y -qq --no-install-recommends cmake ninja-build clang-${{ env.LLVM_VERSION_MAJOR }} lld-${{ env.LLVM_VERSION_MAJOR }} llvm-${{ env.LLVM_VERSION_MAJOR }}
sudo apt-get install -y -qq --no-install-recommends cmake ninja-build clang-${LLVM_VERSION_MAJOR} lld-${LLVM_VERSION_MAJOR} llvm-${LLVM_VERSION_MAJOR}
- name: Setup Rust
run: |
.github/workflows/on-slop.yml
+3
View File
@@ -1,5 +1,8 @@
name: Close AI Slop PRs
permissions:
contents: read
on:
pull_request_target:
types: [labeled]
.github/workflows/packages-ci.yml
+6 -1
View File
@@ -1,5 +1,8 @@
name: Packages CI
permissions:
contents: read
on:
push:
branches:
@@ -29,7 +32,9 @@ jobs:
bun-plugin-svelte:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- name: Setup Bun
uses: ./.github/actions/setup-bun
with:
.github/workflows/release.yml
+60 -64
View File
@@ -6,7 +6,10 @@ concurrency: release
env:
BUN_VERSION: ${{ github.event.inputs.tag || github.event.release.tag_name || 'canary' }}
BUN_LATEST: ${{ (github.event.inputs.is-latest || github.event.release.tag_name) && 'true' || 'false' }}
BUN_LATEST: ${{ (inputs.is-latest || github.event.release.tag_name) && 'true' || 'false' }}
permissions:
contents: read
on:
release:
@@ -61,7 +64,9 @@ jobs:
working-directory: packages/bun-release
steps:
- name: Checkout
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- name: Setup GPG
uses: crazy-max/ghaction-import-gpg@d6f3f49f3345e29369fe57596a3ca8f94c4d2ca7 # v5
with:
@@ -70,12 +75,12 @@ jobs:
- name: Setup Bun
uses: ./.github/actions/setup-bun
with:
bun-version: "1.2.3"
bun-version: "1.3.14"
- name: Install Dependencies
run: bun install
- name: Sign Release
run: |
echo "$GPG_PASSPHRASE" | bun upload-assets -- "${{ env.BUN_VERSION }}"
echo "$GPG_PASSPHRASE" | bun upload-assets -- "$BUN_VERSION"
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
@@ -91,18 +96,19 @@ jobs:
working-directory: packages/bun-release
steps:
- name: Checkout
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
# To workaround issue
ref: main
- name: Setup Bun
uses: ./.github/actions/setup-bun
with:
bun-version: "1.2.3"
bun-version: "1.3.14"
- name: Install Dependencies
run: bun install
- name: Release
run: bun upload-npm -- "${{ env.BUN_VERSION }}" publish
run: bun upload-npm -- "$BUN_VERSION" publish
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
@@ -118,7 +124,9 @@ jobs:
working-directory: packages/bun-types
steps:
- name: Checkout
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- name: Setup Node.js
uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3
with:
@@ -127,7 +135,7 @@ jobs:
if: ${{ env.BUN_VERSION != 'canary' }}
uses: ./.github/actions/setup-bun
with:
bun-version: "1.2.3"
bun-version: "1.3.14"
- name: Setup Bun
if: ${{ env.BUN_VERSION == 'canary' }}
uses: ./.github/actions/setup-bun
@@ -146,19 +154,20 @@ jobs:
run: bun run build
env:
BUN_VERSION: ${{ env.TAG || env.BUN_VERSION }}
- name: Release (canary)
if: ${{ env.BUN_VERSION == 'canary' }}
uses: JS-DevTools/npm-publish@0f451a94170d1699fd50710966d48fb26194d939 # v1
with:
package: packages/bun-types/package.json
token: ${{ secrets.NPM_TOKEN }}
tag: canary
- name: Release (latest)
if: ${{ env.BUN_LATEST == 'true' }}
uses: JS-DevTools/npm-publish@0f451a94170d1699fd50710966d48fb26194d939 # v1
with:
package: packages/bun-types/package.json
token: ${{ secrets.NPM_TOKEN }}
- name: Release
if: ${{ env.BUN_VERSION == 'canary' || env.BUN_LATEST == 'true' }}
env:
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
NPM_CONFIG_USERCONFIG: ${{ runner.temp }}/.npmrc
NPM_TAG: ${{ env.BUN_VERSION == 'canary' && 'canary' || 'latest' }}
run: |
echo '//registry.npmjs.org/:_authToken=${NODE_AUTH_TOKEN}' > "$NPM_CONFIG_USERCONFIG"
VERSION=$(node -p 'require("./package.json").version')
if [ "$(npm view bun-types@"$VERSION" version 2>/dev/null)" = "$VERSION" ]; then
echo "bun-types@$VERSION already published, skipping"
exit 0
fi
npm publish --access public --tag "$NPM_TAG"
definitelytyped:
name: Make pr to DefinitelyTyped to update `bun-types` version
runs-on: ubuntu-latest
@@ -168,17 +177,19 @@ jobs:
contents: read
steps:
- name: Checkout (DefinitelyTyped)
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
repository: DefinitelyTyped/DefinitelyTyped
- name: Checkout (bun)
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
path: bun
- name: Setup Bun
uses: ./bun/.github/actions/setup-bun
with:
bun-version: "1.2.0"
bun-version: "1.3.14"
- id: bun-version
run: echo "BUN_VERSION=${BUN_VERSION#bun-v}" >> "$GITHUB_OUTPUT"
- name: Update bun-types version in package.json
@@ -186,7 +197,7 @@ jobs:
bun -e '
const file = Bun.file("./types/bun/package.json");
const json = await file.json();
const version = "${{ steps.bun-version.outputs.BUN_VERSION }}";
const version = process.env.BUN_VERSION.replace(/^bun-v/, "");
json.dependencies["bun-types"] = version;
json.version = version.slice(0, version.lastIndexOf(".")) + ".9999";
await file.write(JSON.stringify(json, null, 4) + "\n");
@@ -229,7 +240,9 @@ jobs:
suffix: -distroless
steps:
- name: Checkout
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- name: Setup Docker emulator
uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3
- id: buildx
@@ -275,30 +288,33 @@ jobs:
if: ${{ github.event_name == 'release' || github.event.inputs.use-homebrew == 'true' }}
steps:
- name: Checkout
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
repository: oven-sh/homebrew-bun
token: ${{ secrets.ROBOBUN_TOKEN }}
- id: gpg
name: Setup GPG
persist-credentials: false
- name: Setup GPG
uses: crazy-max/ghaction-import-gpg@d6f3f49f3345e29369fe57596a3ca8f94c4d2ca7 # v5
with:
gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }}
passphrase: ${{ secrets.GPG_PASSPHRASE }}
git_user_signingkey: true
git_commit_gpgsign: true
git_committer_name: robobun
git_committer_email: robobun@oven.sh
- name: Setup Ruby
uses: ruby/setup-ruby@6aaa311d81eba98ae12eaffbcb63296ace0efcde # v1
with:
ruby-version: "2.6"
- name: Update Tap
run: ruby scripts/release.rb "${{ env.BUN_VERSION }}"
run: ruby scripts/release.rb "$BUN_VERSION"
- name: Commit Tap
uses: stefanzweifel/git-auto-commit-action@3ea6ae190baf489ba007f7c92608f33ce20ef04a # v4
with:
commit_options: --gpg-sign=${{ steps.gpg.outputs.keyid }}
commit_message: Release ${{ env.BUN_VERSION }}
commit_user_name: robobun
commit_user_email: robobun@oven.sh
commit_author: robobun <robobun@oven.sh>
env:
ROBOBUN_TOKEN: ${{ secrets.ROBOBUN_TOKEN }}
run: |
git add -A
git diff --cached --quiet && exit 0
git commit -m "Release $BUN_VERSION"
git push "https://x-access-token:${ROBOBUN_TOKEN}@github.com/oven-sh/homebrew-bun" HEAD:main
s3:
name: Upload to S3
runs-on: ubuntu-latest
@@ -311,15 +327,17 @@ jobs:
working-directory: packages/bun-release
steps:
- name: Checkout
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- name: Setup Bun
uses: ./.github/actions/setup-bun
with:
bun-version: "1.2.0"
bun-version: "1.3.14"
- name: Install Dependencies
run: bun install
- name: Release
run: bun upload-s3 -- "${{ env.BUN_VERSION }}"
run: bun upload-s3 -- "$BUN_VERSION"
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
@@ -344,25 +362,3 @@ jobs:
version: ${{ env.BUN_VERSION }}
environment: production
bump:
name: "Bump version"
runs-on: ubuntu-latest
if: ${{ github.event_name != 'schedule' }}
permissions:
pull-requests: write
contents: write
steps:
- name: Checkout
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
if: ${{ env.BUN_LATEST == 'true' }}
- name: Setup Bun
uses: ./.github/actions/setup-bun
if: ${{ env.BUN_LATEST == 'true' }}
with:
bun-version: "1.2.0"
- name: Bump version
uses: ./.github/actions/bump
if: ${{ env.BUN_LATEST == 'true' }}
with:
version: ${{ env.BUN_VERSION }}
token: ${{ github.token }}
.github/workflows/source-lints.yml
+2 -2
View File
@@ -37,7 +37,7 @@ on:
merge_group:
env:
BUN_VERSION: "1.3.2"
BUN_VERSION: "1.3.14"
jobs:
source-lints:
@@ -49,7 +49,7 @@ jobs:
# PR pushes supersede earlier runs; main commits always run to completion.
cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
steps:
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- name: Setup Bun
.github/workflows/stale.yaml
+3
View File
@@ -1,4 +1,7 @@
name: Close inactive issues
permissions:
contents: read
on:
# schedule:
# - cron: "15 * * * *"
.github/workflows/test-bump.yml
-32
View File
@@ -1,32 +0,0 @@
name: Test Bump version
on:
workflow_dispatch:
inputs:
version:
type: string
description: What is the release tag? (e.g. "1.0.2", "canary")
required: true
env:
BUN_VERSION: "1.2.0"
jobs:
bump:
name: "Bump version"
runs-on: ubuntu-latest
permissions:
pull-requests: write
contents: write
steps:
- name: Checkout
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
- name: Setup Bun
uses: ./.github/actions/setup-bun
with:
bun-version: ${{ env.BUN_VERSION }}
- name: Bump version
uses: ./.github/actions/bump
with:
version: ${{ inputs.version }}
token: ${{ github.token }}
.github/workflows/update-cares.yml
+6 -1
View File
@@ -1,5 +1,8 @@
name: Update c-ares
permissions:
contents: read
on:
schedule:
- cron: "0 4 * * 0"
@@ -14,7 +17,9 @@ jobs:
pull-requests: write
steps:
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- name: Check c-ares version
id: check-version
.github/workflows/update-hdrhistogram.yml
+6 -1
View File
@@ -1,5 +1,8 @@
name: Update hdrhistogram
permissions:
contents: read
on:
schedule:
- cron: "0 4 * * 0"
@@ -14,7 +17,9 @@ jobs:
pull-requests: write
steps:
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- name: Check hdrhistogram version
id: check-version
.github/workflows/update-highway.yml
+6 -1
View File
@@ -1,5 +1,8 @@
name: Update highway
permissions:
contents: read
on:
schedule:
- cron: "0 4 * * 0"
@@ -14,7 +17,9 @@ jobs:
pull-requests: write
steps:
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- name: Check highway version
id: check-version
.github/workflows/update-libarchive.yml
+6 -1
View File
@@ -1,5 +1,8 @@
name: Update libarchive
permissions:
contents: read
on:
schedule:
- cron: "0 3 * * 0"
@@ -14,7 +17,9 @@ jobs:
pull-requests: write
steps:
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- name: Check libarchive version
id: check-version
.github/workflows/update-libdeflate.yml
+6 -1
View File
@@ -1,5 +1,8 @@
name: Update libdeflate
permissions:
contents: read
on:
schedule:
- cron: "0 2 * * 0"
@@ -14,7 +17,9 @@ jobs:
pull-requests: write
steps:
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- name: Check libdeflate version
id: check-version
.github/workflows/update-lolhtml.yml
+6 -1
View File
@@ -1,5 +1,8 @@
name: Update lolhtml
permissions:
contents: read
on:
schedule:
- cron: "0 1 * * 0"
@@ -14,7 +17,9 @@ jobs:
pull-requests: write
steps:
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- name: Check lolhtml version
id: check-version
.github/workflows/update-lshpack.yml
+6 -1
View File
@@ -1,5 +1,8 @@
name: Update lshpack
permissions:
contents: read
on:
schedule:
- cron: "0 5 * * 0"
@@ -14,7 +17,9 @@ jobs:
pull-requests: write
steps:
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- name: Check lshpack version
id: check-version
.github/workflows/update-root-certs.yml
-83
View File
@@ -1,83 +0,0 @@
name: Daily Root Certs Update Check
on:
schedule:
- cron: "0 0 * * *" # Runs at 00:00 UTC every day
workflow_dispatch: # Allows manual trigger
jobs:
check-and-update:
if: github.repository == 'oven-sh/bun'
runs-on: ubuntu-latest
permissions:
contents: write
pull-requests: write
steps:
- name: Checkout repository
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
- name: Setup Bun
uses: oven-sh/setup-bun@f4d14e03ff726c06358e5557344e1da148b56cf7 # v1
with:
bun-version: latest
- name: Generate root certs and capture output
id: generate-certs
run: |
cd packages/bun-usockets/
OUTPUT=$(bun generate-root-certs.mjs -v)
echo "cert_output<<EOF" >> $GITHUB_ENV
echo "$OUTPUT" >> $GITHUB_ENV
echo "EOF" >> $GITHUB_ENV
- name: Check for changes and stage files
id: check-changes
run: |
if [[ -n "$(git status --porcelain)" ]]; then
echo "Found changes, staging modified files..."
git config --global user.name "github-actions[bot]"
git config --global user.email "github-actions[bot]@users.noreply.github.com"
# Get list of modified files and add them
git status --porcelain | while read -r status file; do
# Remove leading status and whitespace
file=$(echo "$file" | sed 's/^.* //')
echo "Adding changed file: $file"
git add "$file"
done
echo "changes=true" >> $GITHUB_OUTPUT
# Store the list of changed files
CHANGED_FILES=$(git status --porcelain)
echo "changed_files<<EOF" >> $GITHUB_ENV
echo "$CHANGED_FILES" >> $GITHUB_ENV
echo "EOF" >> $GITHUB_ENV
else
echo "No changes detected"
echo "changes=false" >> $GITHUB_OUTPUT
fi
- name: Create Pull Request
if: steps.check-changes.outputs.changes == 'true'
uses: peter-evans/create-pull-request@4e1beaa7521e8b457b572c090b25bd3db56bf1c5 # v5
with:
token: ${{ secrets.GITHUB_TOKEN }}
commit-message: "update(root_certs): Update root certificates $(date +'%Y-%m-%d')"
title: "update(root_certs) $(date +'%Y-%m-%d')"
body: |
Automated root certificates update
${{ env.cert_output }}
## Changed Files:
```
${{ env.changed_files }}
```
branch: certs/update-root-certs
base: main
delete-branch: true
labels:
- "automation"
- "root-certs"
.github/workflows/update-sqlite3.yml
+10 -2
View File
@@ -1,5 +1,8 @@
name: Update SQLite3
permissions:
contents: read
on:
schedule:
- cron: "0 6 * * 0" # Run weekly
@@ -14,7 +17,9 @@ jobs:
pull-requests: write
steps:
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- name: Check SQLite version
id: check-version
@@ -70,8 +75,11 @@ jobs:
- name: Update SQLite if needed
if: success() && steps.check-version.outputs.current_num < steps.check-version.outputs.latest_num
env:
LATEST_NUM: ${{ steps.check-version.outputs.latest_num }}
LATEST_YEAR: ${{ steps.check-version.outputs.latest_year }}
run: |
./scripts/update-sqlite-amalgamation.sh ${{ steps.check-version.outputs.latest_num }} ${{ steps.check-version.outputs.latest_year }}
./scripts/update-sqlite-amalgamation.sh "$LATEST_NUM" "$LATEST_YEAR"
- name: Create Pull Request
if: success() && steps.check-version.outputs.current_num < steps.check-version.outputs.latest_num
.github/workflows/update-vendor.yml
+7 -2
View File
@@ -1,5 +1,8 @@
name: Update vendor
permissions:
contents: read
on:
schedule:
- cron: "0 4 * * 0"
@@ -19,8 +22,10 @@ jobs:
- elysia
steps:
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
- uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- uses: ./.github/actions/setup-bun
- name: Check version
id: check-version
.github/workflows/update-zstd.yml
+6 -1
View File
@@ -1,5 +1,8 @@
name: Update zstd
permissions:
contents: read
on:
schedule:
- cron: "0 1 * * 0"
@@ -14,7 +17,9 @@ jobs:
pull-requests: write
steps:
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- name: Check zstd version
id: check-version
.github/workflows/vscode-release.yml
+10 -3
View File
@@ -1,4 +1,7 @@
name: VSCode Extension Publish
permissions:
contents: read
on:
workflow_dispatch:
inputs:
@@ -13,12 +16,14 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- name: Setup Bun
uses: ./.github/actions/setup-bun
with:
bun-version: "1.2.18"
bun-version: "1.3.14"
- name: Install dependencies (root)
run: bun install
@@ -28,7 +33,9 @@ jobs:
working-directory: packages/bun-vscode
- name: Set Version
run: bun pm version ${{ github.event.inputs.version }} --no-git-tag-version --allow-same-version
env:
VERSION: ${{ inputs.version }}
run: bun pm version "$VERSION" --no-git-tag-version --allow-same-version
working-directory: packages/bun-vscode
- name: Build (inspector protocol)