merge dev to main (add bun setup to CI)

[ymc9]

Summary by CodeRabbit

• Chores
  • Updated CI/CD pipeline configuration to optimize build environment setup.

_{✏️ Tip: You can customize this high-level summary in your review settings.}

[coderabbitai]

Caution

Review failed

The pull request is closed.

Walkthrough

Adds a new GitHub Actions workflow step to install Bun (using oven-sh/setup-bun@v2 with latest version) in the publish-release workflow. The step is positioned after Node.js setup and before dependency installation to ensure Bun availability during the build process.

Changes

Cohort / File(s)	Change Summary
GitHub Actions Workflow Updates .github/workflows/publish-release.yml	Added "Use Bun" step to install Bun via oven-sh/setup-bun@v2 action with version set to latest, placed in execution sequence after Node.js setup and before "Install dependencies" step.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

This change involves a straightforward addition of a single, well-documented GitHub Actions step with standard configuration. No complex logic, conditional branching, or multi-file coordination is required.

Possibly related PRs

• merge dev to main (v3.0.0-beta.3) #238: Modifies the same CI workflow file (.github/workflows/publish-release.yml) to add post-build script execution in the Build step.

Poem

🐰 Hop, hop, the Bun arrives in CI,
No more waiting for builds to fly,
After Node and before deps take hold,
Fresh package manager, swift and bold! 🚀

✨ Finishing touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch dev

---

📜 Recent review details

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 4b598bb and d3bfc9d.

📒 Files selected for processing (1)

• .github/workflows/publish-release.yml (1 hunks)

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[claude]

Claude finished @ymc9's task —— View job

---

Code Review: Add Bun Setup to CI

Reviewing the PR that adds bun setup to the CI workflow.

Todo List:

• Read and analyze the workflow file changes
• Review code quality and best practices
• Check for potential bugs or issues
• Evaluate performance considerations
• Assess security concerns
• Review test coverage implications
• Provide comprehensive feedback

---

Review Summary

The change adds bun runtime setup to the CI publish-release workflow, which is needed for running bun-specific tests and potentially for building/testing packages that depend on bun.

Code Quality & Best Practices ✅

Positive aspects:

• The bun setup follows the same pattern as the existing Node.js and pnpm setup steps
• Uses the official oven-sh/setup-bun@v2 action
• Placed logically after Node.js setup and before dependency installation
• Consistent indentation and formatting with the rest of the workflow

Potential Issues & Security 🔍

Minor concerns identified:

1. Version Pinning (Low Priority):

   bun-version: latest

   • Using latest can introduce non-deterministic builds
   • Consider pinning to a specific version like 1.1.38 for reproducibility
   • The build-test.yml workflow has the same pattern, so this is consistent

2. Unused Setup (Documentation):

   • The workflow doesn't appear to explicitly run bun commands after setup
   • However, this is likely needed for the bun E2E tests in tests/runtimes/bun/
   • The bun setup enables running bun test commands which are used in the test suite

Performance Considerations ⚡

Impact assessment:

• Minimal overhead: Adding bun setup adds ~5-10 seconds to the CI run
• Caching: Bun installation is typically fast and the action includes caching
• Parallel setup: Setup runs before dependency installation, so it doesn't block other operations

Security Considerations 🔒

Security posture:

• Action source: Uses official oven-sh/setup-bun@v2 from Bun's official organization ✅
• Permissions: No additional permissions required ✅
• Version specification: Using latest is acceptable for CI but consider pinning for production

Test Coverage 📋

Context from codebase analysis:

• The repository includes bun E2E tests in tests/runtimes/bun/
• Tests verify ZenStack compatibility with Bun's SQLite implementation (bun:sqlite)
• Tests cover CRUD operations and policy enforcement
• The bun setup is essential for running these tests during CI

Recommendations

1. Optional Enhancement: Consider pinning bun version for better reproducibility:

   - name: Use Bun
     uses: oven-sh/setup-bun@v2
     with:
         bun-version: 1.1.38  # or latest stable version

2. Consistency: The change aligns with the existing build-test.yml workflow which already includes bun setup

3. Documentation: No changes needed to documentation as this is an internal CI improvement

Conclusion

✅ APPROVED - This is a well-implemented addition that:

• Follows established patterns and best practices
• Enables proper testing of bun runtime compatibility
• Has minimal security or performance impact
• Maintains consistency with existing CI workflows

The change is necessary for comprehensive testing of ZenStack's multi-runtime support and should be merged.

[Copilot]

Pull request overview

This PR merges changes from the dev branch to main, specifically adding Bun runtime setup to the publish-release CI workflow. This change brings the publish-release workflow into alignment with the build-test workflow, ensuring that Bun runtime tests (located in tests/runtimes/bun/) can be executed during the release process. The repository uses pnpm for package management, while Bun is set up as a supplementary runtime environment for testing ZenStack's compatibility with the Bun runtime.

• Adds Bun setup step to the publish-release workflow
• Maintains consistency with existing build-test workflow configuration
• Ensures Bun runtime tests can execute during releases

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review for a chance to win a $100 gift card. Take the survey.

[Copilot]

Consider pinning to a specific Bun version instead of using 'latest' for more reproducible builds. This is especially important for release workflows where consistency and predictability are critical. For example, you could use a specific version like bun-version: 1.3.3 to match the bun-types version specified in tests/runtimes/bun/package.json.

Suggested change

	bun-version: latest
	bun-version: 1.3.3