[lidge-jun]

Summary

The daily orphaned-workflow cleanup job still installed Bun 1.4.2 through a hand-pinned oven-sh/setup-bun step, after every other workflow had moved to the package.json pin (1.4.4). This PR closes the remaining gaps so Bun 1.4.4 is the single version in the repository:

• .github/workflows/cleanup-orphaned-workflows.yml now installs Bun through ./.github/actions/setup-project-bun (runtime role), so it reads dependencies.bun from package.json.
• @types/bun moves from 1.4.0 to 1.4.4 (pulls bun-types 1.4.4); bun.lock was regenerated with the pinned Bun 1.4.4.
• Tests read the version from package.json instead of a literal: install-scripts.test.ts asserts @types/bun equals dependencies.bun, and cleanup-orphaned-workflows.test.ts asserts the job uses the composite after checkout, has no direct oven-sh/setup-bun step and no bun-version literal.
• .github/workflows/deploy-docs.yml built the docs with withastro/action package-manager: bun@latest, an unpinned Bun. It now requests bun@1.4.4 (the action splits name@version and passes it to the same pinned oven-sh/setup-bun SHA), and the existing deploy-docs hardening test in ci-workflows.test.ts asserts it equals bun@<package.json dependencies.bun>. npm latest is 1.4.4 today, so the built output does not change; this stops future drift. Permissions, triggers and action SHAs in that workflow are unchanged.
• structure/runtime.md no longer says @types/bun "remains unchanged".

dependencies.bun and testRunnerBun stay separate keys.

Why the composite instead of a hardcoded 1.4.4 plus a test. The composite needs ./package.json on disk, and this workflow already checks out the repository: trusted default-branch code (schedule and push to main only), actions/checkout pinned by SHA, persist-credentials: false. So switching adds no checkout, no permission, no trigger and no token exposure. The composite resolves the version with a Node snippet over the checked-out package.json and then calls the same pinned oven-sh/setup-bun@0c5077e5… SHA this job used before. GITHUB_TOKEN is still only passed to the final script step. Triggers, permissions, concurrency and job matrices are unchanged.

Sweep for other pins. rg over .github, scripts, desktop, gui, docs-site, Dockerfiles and structure found no other toolchain pin below 1.4.4; the security review flagged the unpinned bun@latest above, which is now pinned. Remaining 1.3.x/1.4.0–1.4.3 mentions are dated comments explaining past Bun behaviour, test fixtures (e.g. the resolver fixture in ci-scope-gaps.test.ts, version-parsing tests), MIN_FIXED_BUN_VERSION thresholds, and unrelated Cargo/User-Agent versions; those are left alone. The localized troubleshooting/windows-memory.md pages still describe the bundled runtime as 1.3.14; that is stale user documentation, not a pin, and is out of scope here.

Closes #7811

Verification

Run on Windows with the pinned node_modules/bun 1.4.4:

• bun install (lock update), then bun install --frozen-lockfile: no changes, exit 0
• bun run typecheck: exit 0
• bun test --isolate tests/ci-workflows/cleanup-orphaned-workflows.test.ts tests/ci-workflows/install-scripts.test.ts tests/ci-workflows/ci-workflows.test.ts tests/ci-workflows/ci-scope-gaps.test.ts tests/test-layout.test.ts tests/test-layout-tooling.test.ts: 217 pass / 4 skip / 1 fail. The failure is setup-project-bun pin resolution > each role fails closed … timing out at 5 s; it spawns Node 16 times, reads no file this PR changes, and on this host takes ~4.5 s (re-run 3×: 5.8 s fail, 4.49 s pass, 4.49 s pass). Host timing, not a regression.
• deploy-docs pin: bun test --isolate tests/ci-workflows/ci-workflows.test.ts -t "docs deployment is pinned" fails with bun@latest restored and passes with the pin. A full re-run of ci-workflows.test.ts + cleanup-orphaned-workflows.test.ts on the second head gave 144 pass / 1 skip / 4 fail; the four are doctor-gui-if-changed/lint-gui-if-changed subprocess tests that hit the 5 s timeout after 20-30 s under host load (the same file passed fully on the first head) and touch nothing in this diff.
• bun run structure:check, bun run privacy:scan, git diff --check: pass
• bun run test:changed: stopped locally after ~10 min without output under host resource pressure; because this diff changes a dependency, PR CI runs the four full Ubuntu test shards on the exact head instead

NOT RUN: full bun run test and test:changed to completion locally (left to the CI shards), macOS/Windows CI lanes (manual dispatch only by policy), a live run of the cleanup workflow (it only runs on main).

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed.
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults.

Summary by CodeRabbit

• Chores
  • Updated the cleanup workflow to use the repository’s standard Bun setup, removing its separate version setting.
  • Updated the Bun type definitions to version 1.4.4, with automated checks ensuring they match the configured runtime.
  • Set the documentation build workflow to use the configured Bun version instead of the latest release, with checks to keep the versions aligned.
• Documentation
  • Clarified that Bun type definitions track the shipped runtime version.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-27T12:29:38.996086Z	—	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

✅ Deterministic PR hygiene checks passed.

[coderabbitai]

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: lidge-jun/opencodex
• Branch: chore/bun-1-4-4-everywhere
• File: .coderabbit.yaml
• Commit: 6c3a6bf
• Layers: Repository YAML
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 11187fc9-6ae6-4f6b-975b-4e62368e9cd8

Commits

Reviewing files that changed from the base of the PR and between c631602 and 6c3a6bf.

Files selected for processing: 2

• .github/workflows/deploy-docs.yml
• tests/ci-workflows/ci-workflows.test.ts

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 8 remain after this review.

Walkthrough

The changes align Bun versions across package metadata, the cleanup and docs deployment workflows, runtime documentation, and CI tests. The cleanup workflow uses the repository setup action, and the docs deployment workflow uses a pinned Bun version.

Changes: Bun version alignment

Layer / File(s)	Summary
Align the Bun type dependency with the runtime pin package.json, structure/runtime.md, tests/ci-workflows/install-scripts.test.ts	@types/bun is updated to 1.4.4. The runtime documentation and package test describe and check its relationship to the Bun runtime dependency.
Use the project Bun setup in the cleanup workflow .github/workflows/cleanup-orphaned-workflows.yml, tests/ci-workflows/cleanup-orphaned-workflows.test.ts	The workflow replaces the explicit Bun 1.4.2 setup with setup-project-bun. The test checks checkout order, absence of action inputs, and removal of the old action and bun-version text.
Pin Bun in the docs deployment workflow .github/workflows/deploy-docs.yml, tests/ci-workflows/ci-workflows.test.ts	The workflow replaces bun@latest with bun@1.4.4. The test checks that its package-manager version matches the package dependency and has a three-part numeric format.

Priority: Low

Estimated code review effort: 2 (Simple) | ~8 minutes

Change: Other · Severity of issue fixed: Low

Possibly related PRs

• lidge-jun/opencodex#7606: Updates the Bun runtime dependency and related documentation and version assertion, which this PR uses in workflow configuration and tests.

Merge Risk: Minimal · up to 6c3a6

No merge-blocking risk is identified; the Bun pins and workflow checks are aligned.

Pre-merge checks: 5

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main change: CI workflows now use the Bun version declared in package.json. It matches the cleanup workflow, documentation workflow, and related version-a…
Linked Issues check		Issue #7811 requires .github/workflows/cleanup-orphaned-workflows.yml to use the repository Bun pin instead of the hardcoded 1.4.2 pin. The workflow now checks out the repository and then uses `./.g…
Out of Scope Changes check		The changed files remain connected to the Bun pin objective in #7811. The @types/bun update, bun.lock regeneration, install-scripts.test.ts alignment check, and structure/runtime.md correction…
Docstring Coverage		No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Documentation-only edits and deletions within survi…

Full details: Title check

Explanation

The title clearly and concisely describes the main change: CI workflows now use the Bun version declared in package.json. It matches the cleanup workflow, documentation workflow, and related version-alignment tests.

Full details: Linked Issues check

Explanation

Issue #7811 requires .github/workflows/cleanup-orphaned-workflows.yml to use the repository Bun pin instead of the hardcoded 1.4.2 pin. The workflow now checks out the repository and then uses ./.github/actions/setup-project-bun at .github/workflows/cleanup-orphaned-workflows.yml in the Setup Bun step. The composite resolves dependencies.bun from package.json and passes the resolved version to the SHA-pinned oven-sh/setup-bun action in .github/actions/setup-project-bun/action.yml. The workflow test also checks checkout ordering, absence of a direct oven-sh/setup-bun step, and absence of a bun-version literal. These changes satisfy the issue objective and reduce future version drift.

Full details: Out of Scope Changes check

Explanation

The changed files remain connected to the Bun pin objective in #7811. The @types/bun update, bun.lock regeneration, install-scripts.test.ts alignment check, and structure/runtime.md correction keep package metadata, types, lock data, tests, and documentation consistent with dependencies.bun. The deploy-docs.yml change replaces bun@latest with bun@1.4.4, and ci-workflows.test.ts verifies that value against package.json; this prevents another repository workflow from drifting from the same runtime pin. The cleanup workflow keeps its checkout, permissions, triggers, concurrency, and final token use unchanged. No unrelated implementation or cleanup is demonstrated.

Full details: Docstring Coverage

Explanation

No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 3 files. (1 skipped: 1 unsupported.)

Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[lidge-jun]

Maintainer integration into dev (MAINTAINERS.md, dev-only exception), recorded before merge.

• Head 6c3a6bfbac1c64ec0e66da5658f4979273a2825c, base dev at 42549ba1b00a7fe792f0c1d87771845ca538c472 (0 commits behind).
• Exact-head CI: all 33 checks passed on 6c3a6bf, including gates, the four full Ubuntu shards and desktop shell (run 40506085506), plus catalog async contracts (40506085432), service lifecycle, enforce-target and hygiene.
• Security review (GitHub Actions + dependency installation): two independent rounds, both PASS with 0 blocking findings. Round 1 at c6316020 covered the cleanup workflow, @types/bun and bun.lock (hashes checked against the npm tarballs). Its non-blocking bun@latest note in deploy-docs.yml was accepted and fixed in 6c3a6bf; round 2 at 6c3a6bf reviewed that change and re-confirmed round 1.
• CodeRabbit: no actionable comments on 6c3a6bf. Codex review: completed, no findings. No outstanding maintainer change requests.

This is maintainer integration, not an approving review.