[marcusrbrown]

Repo TypeScript scripts now run on Bun instead of Node. This continues the pnpm → Bun migration in docs/plans/2026-10-19-002-refactor-bun-migration-plan.md. Vitest and Stryker move in later PRs.

Changes

• Workflows: 77 node scripts/… calls across 20 workflows now run bun scripts/….
  • publish-wiki.yaml gets its own SHA-pinned oven-sh/setup-bun with no-cache: true.
  • Every other converted job already gets Bun from the shared setup action.
• Package scripts: build and the non-Renovate check:* scripts now run on Bun.
• Agent prompts: commands now run on Bun.
• Operator remediation text: now names Bun.
• Keeping Node behavior under Bun:
  • bunfig.toml sets env = false, so .env is not loaded automatically.
  • bunfig.toml sets [install] auto = "disable", so a missing import fails instead of being installed from the registry.
  • The three steps that run from a directory other than the repo root (the publish-wiki lockfile gates and merge-data's private-wiki check) pass --no-install --no-env-file, because Bun reads bunfig.toml from the working directory only.
  • Scripts whose success path writes to stdout now set process.exitCode instead of calling process.exit(0). Bun truncates piped output at 64 KiB when the process exits before the pipe drains.
• Tests: the workflow step test helper stubs bun. The data-branch probe tests assert that neither bun nor node runs after a failed probe.
• Guidance: names Bun as the script runtime and lists the Node exceptions.

Still on Node

• The "Test Scripts Load" job. It checks Node strip-only loading, and its context name is unchanged.
• The private-leak scan, both the check-private-leak.yaml job and the merge-data.yaml --promotion run.
• check:renovate-config. re2's prebuilt binary targets Node ABI 137, and Bun 1.4.3 needs ABI 147, so RE2 cannot load under Bun.
• The Vitest step of coverage, plus Vitest and Stryker in general.
• npm publish, the publish job's tool install, and the Quartz build.

Verification

All of the following exit 0 on a clean node_modules:

• bun install --frozen-lockfile
• check-types
• lint
• test: 5648 passed, 43 skipped, 3 todo, matching main
• check:wiki-write-core-dist
• check:renovate-config
• check:mutation-guards
• actionlint
• both integration suites

Further checks:

• All 45 scripts the workflows call give matching exit codes under Bun and Node, and none exits silently.
• rollout-tracker-snapshot.ts delivers its full 309,378-byte payload through a slow pipe. Before this change it delivered 65,536 bytes.
• With yaml missing, the publish-wiki lockfile gate exits 2.
• A repo-root .env value is not visible to bun scripts/….

Not run before merge

Most converted workflows run only on a schedule, on dispatch, or behind a path filter, so PR CI doesn't exercise them on Bun. These need a run after merge:

• capture-learnings, capture-patterns, cross-repo-dispatch, dispatch-renovate, draft-solutions, fro-bot, gateway-rollout-tracker, improvement-metrics, merge-data, poll-invitations, publish-wiki, reconcile-repos, release-wiki-write-core (decide), rename-tracked-repo, reset-survey-status, status-truth, survey-repo, update-metadata, wiki-lint

[fro-bot]

Verdict: PASS

No confirmed correctness or security regressions. Bun setup, named Node exceptions, pinned actions, and trusted publishing boundaries are preserved, consistent with the trusted-publisher pattern.

Verified 1,084 tests across 17 files (21 skipped), YAML shape and action pins across 20 workflows, and matching Bun/Node output and exit codes in focused probes. Bun delivered the complete 99,684-byte snapshot through a delayed reader.

Blocking issues

None

Non-blocking concerns

None

Missing tests

Some existing CLI subprocess tests still exercise Node. Retaining representative Bun success/error and slow-pipe cases would make the manual parity checks repeatable; this is follow-up coverage, not a merge blocker.

Risk assessment (MED) + rationale

The runtime switch spans privileged automation. Live scheduled workflows and isolated Quartz/release-tool execution were not exercised during this review. Follow the staged post-merge validation documented in the PR.

---

Run Summary

Field	Value
Event	pull_request
Repository	fro-bot/.github
Run ID	39408483670
Cache	hit
Session	ses_ea721f226ffeSVS0UJukOQ4s2T

[fro-bot]

Verdict: PASS

Approval renewed. The rebased merge tree is identical to the previously approved tree (c7145973a7af9a85dfb9769773365362f81873e2), against the same base commit.

The previous 1,084 passing tests and Bun/Node runtime probes remain applicable; they were not rerun for this unchanged tree.

Blocking issues

None

Non-blocking concerns

None

Missing tests

No new gaps. The previously noted Bun-specific subprocess regression coverage remains follow-up work.

Risk assessment (MED) + rationale

The migration spans privileged automation. Live scheduled workflows and isolated Quartz/release-tool execution still need the staged post-merge validation documented in the PR.

---

Run Summary

Field	Value
Event	pull_request
Repository	fro-bot/.github
Run ID	39408676679
Cache	hit
Session	ses_ea721f226ffeSVS0UJukOQ4s2T