feat: add bun to controller#387
Conversation
Signed-off-by: sujitaw <sujit.sutar@ayanworks.com>
📝 WalkthroughWalkthroughUpdate scripts and CI to use Bun (replacing Yarn commands) and add a top-level ChangesPackage Manager and Dependency Configuration
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 inconclusive)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@package.json`:
- Line 39: The validate script currently mixes package managers ("validate") by
calling bun lint && yarn check-types && yarn check-format; update it to use bun
consistently by invoking the other scripts via bun (e.g., replace the yarn calls
with bun run check-types and bun run check-format) and ensure the referenced
scripts check-types and check-format exist in package.json so all parts of
"validate" use bun only.
- Around line 26-39: Update CI/CD and project files to complete the yarn→bun
migration: modify the workflow referenced by continuous-integration.yml to
change cache: 'yarn' → 'bun' (or remove), replace `yarn install` with `bun
install`, and change `yarn lint`, `yarn check-format`, `yarn check-types` to
`bun lint`, `bun check-format`, `bun check-types`; update .github/dependabot.yml
to rename the 'yarn' label to 'bun'; remove yarn.lock and ensure bun.lockb is
generated and committed; and update developer setup docs/README to document
using bun so scripts like the package.json "validate" (which currently runs `bun
lint && yarn check-types && yarn check-format`) and other scripts
("format","check-format","lint","validate","dev","build") consistently use bun
commands.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 7d0b27ac-8d92-4340-bae5-468f17c4090d
⛔ Files ignored due to path filters (1)
bun.lockis excluded by!**/*.lock
📒 Files selected for processing (1)
package.json
Signed-off-by: sujitaw <sujit.sutar@ayanworks.com>
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.github/workflows/continuous-integration.yml (1)
22-29:⚠️ Potential issue | 🔴 Critical | ⚡ Quick winAdd explicit Bun installation and fix cache configuration.
actions/setup-nodedoes not install Bun—it only sets up Node.js. Line 29 will fail withbun: command not found. Additionally,cache: 'bun'is not supported by setup-node; it only supports npm, yarn, and pnpm.Proposed fix
- name: Setup node v20 uses: actions/setup-node@v4 with: node-version: 20 - cache: 'bun' + - name: Setup Bun + uses: oven-sh/setup-bun@v2 + + - name: Cache Bun dependencies + uses: actions/cache@v4 + with: + path: ~/.bun/install/cache + key: bun-${{ runner.os }}-${{ hashFiles('bun.lockb') }} + restore-keys: bun-${{ runner.os }}- + - name: Install dependencies run: bun install🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/continuous-integration.yml around lines 22 - 29, The workflow uses actions/setup-node with cache: 'bun' and then runs "bun install", which fails because setup-node doesn't provide Bun and its cache option doesn't support 'bun'; update the "Setup node v20" step to remove or change the unsupported cache value (use supported values like 'npm'/'yarn'/'pnpm' or omit), and add an explicit Bun installation step before the "Install dependencies" step (either use an official setup action such as actions/setup-bun or run a short install script to install Bun), ensuring the "Install dependencies" step still runs "bun install" after Bun is available.
🧹 Nitpick comments (1)
.github/workflows/continuous-integration.yml (1)
29-29: ⚡ Quick winUse a frozen lockfile in CI installs for deterministic builds.
On Line 29, prefer
bun install --frozen-lockfileso CI fails on lockfile drift instead of silently changing dependency resolution.Proposed fix
- - name: Install dependencies - run: bun install + - name: Install dependencies + run: bun install --frozen-lockfile🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/continuous-integration.yml at line 29, Update the CI install step that currently runs "bun install" to use a frozen lockfile by changing the command to "bun install --frozen-lockfile" so the workflow fails on lockfile drift instead of mutating dependencies; locate the run step that executes bun install in the continuous integration workflow and replace the command accordingly.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In @.github/workflows/continuous-integration.yml:
- Around line 22-29: The workflow uses actions/setup-node with cache: 'bun' and
then runs "bun install", which fails because setup-node doesn't provide Bun and
its cache option doesn't support 'bun'; update the "Setup node v20" step to
remove or change the unsupported cache value (use supported values like
'npm'/'yarn'/'pnpm' or omit), and add an explicit Bun installation step before
the "Install dependencies" step (either use an official setup action such as
actions/setup-bun or run a short install script to install Bun), ensuring the
"Install dependencies" step still runs "bun install" after Bun is available.
---
Nitpick comments:
In @.github/workflows/continuous-integration.yml:
- Line 29: Update the CI install step that currently runs "bun install" to use a
frozen lockfile by changing the command to "bun install --frozen-lockfile" so
the workflow fails on lockfile drift instead of mutating dependencies; locate
the run step that executes bun install in the continuous integration workflow
and replace the command accordingly.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 8e6fcb5f-edd3-4578-8cfd-3757351446f4
📒 Files selected for processing (2)
.github/workflows/continuous-integration.ymlpackage.json
🚧 Files skipped from review as they are similar to previous changes (1)
- package.json
…int issues Signed-off-by: KambleSahil3 <sahil.kamble@ayanworks.com>
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
.github/workflows/continuous-integration.yml (1)
29-30: ⚡ Quick winConsider pinning the bun version for reproducibility.
The setup step doesn't specify a
bun-version, which means CI will use the latest available version. This could lead to unexpected failures if a new bun release introduces breaking changes.📌 Proposed fix to pin the bun version
- name: Setup bun uses: oven-sh/setup-bun@v2 + with: + bun-version: latestOr pin to a specific version for maximum reproducibility:
- name: Setup bun uses: oven-sh/setup-bun@v2 + with: + bun-version: 1.1.0🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/continuous-integration.yml around lines 29 - 30, The CI step using the GitHub Action "Setup bun" (uses: oven-sh/setup-bun@v2) should pin a specific bun version by adding the bun-version input (e.g., bun-version: "1.5.0" or a tested semantic version) to the action configuration so the workflow uses a fixed, reproducible bun release instead of the latest.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/continuous-integration.yml:
- Line 33: Update the CI step that runs the package install so it uses a frozen
lockfile: change the run command that currently invokes "bun install" to include
the "--frozen-lockfile" flag (i.e., "bun install --frozen-lockfile") so the
workflow step invoking bun install will fail on lockfile drift and produce
reproducible builds.
---
Nitpick comments:
In @.github/workflows/continuous-integration.yml:
- Around line 29-30: The CI step using the GitHub Action "Setup bun" (uses:
oven-sh/setup-bun@v2) should pin a specific bun version by adding the
bun-version input (e.g., bun-version: "1.5.0" or a tested semantic version) to
the action configuration so the workflow uses a fixed, reproducible bun release
instead of the latest.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 0d639cef-821f-4292-b4b1-4ddb1b923664
📒 Files selected for processing (1)
.github/workflows/continuous-integration.yml
|
|
||
| - name: Install dependencies | ||
| run: yarn install | ||
| run: bun install |
There was a problem hiding this comment.
Use --frozen-lockfile flag for reproducible CI builds.
The bun install command should include the --frozen-lockfile flag in CI environments to ensure reproducible builds and catch any drift between package.json and the lockfile.
🔒 Proposed fix to add frozen lockfile flag
- name: Install dependencies
- run: bun install
+ run: bun install --frozen-lockfile📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| run: bun install | |
| run: bun install --frozen-lockfile |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/continuous-integration.yml at line 33, Update the CI step
that runs the package install so it uses a frozen lockfile: change the run
command that currently invokes "bun install" to include the "--frozen-lockfile"
flag (i.e., "bun install --frozen-lockfile") so the workflow step invoking bun
install will fail on lockfile drift and produce reproducible builds.
Signed-off-by: KambleSahil3 <sahil.kamble@ayanworks.com>
Signed-off-by: KambleSahil3 <sahil.kamble@ayanworks.com>
Signed-off-by: KambleSahil3 <sahil.kamble@ayanworks.com>
Signed-off-by: sujitaw <sujit.sutar@ayanworks.com>
…ebl/agent-controller into feat/add_bun_for_controller
|
There was a problem hiding this comment.
Actionable comments posted: 2
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
package.json (1)
69-69:⚠️ Potential issue | 🔴 Critical | ⚡ Quick winRemove duplicate dependency specification.
The pipeline warns that
@types/ref-struct-diis specified twice: once independencies(line 69) and again indevDependencies(line 105). Type definitions should only be indevDependencies.🔧 Proposed fix
"`@types/node-fetch`": "^2.6.4", - "`@types/ref-struct-di`": "^1.1.12", "`@types/uuid`": "^10.0.0",🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@package.json` at line 69, Remove the duplicate "`@types/ref-struct-di`" entry from the runtime dependencies block and keep it only under devDependencies; edit package.json to delete the "`@types/ref-struct-di`" line from the "dependencies" section (the one shown in the diff) so type definitions remain exclusively in "devDependencies".
♻️ Duplicate comments (1)
.github/workflows/continuous-integration.yml (1)
35-35:⚠️ Potential issue | 🟠 Major | ⚡ Quick winAdd
--frozen-lockfileflag for reproducible builds.The
bun installcommand in CI should use--frozen-lockfileto ensure the lockfile is not modified and builds are reproducible. This also helps catch drift betweenpackage.jsonand the lockfile.🔒 Proposed fix
- name: Install dependencies - run: bun install + run: bun install --frozen-lockfile🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/continuous-integration.yml at line 35, Update the CI step that runs the package installation so it uses Bun's frozen lockfile check: replace the current "run: bun install" invocation with a command that adds the --frozen-lockfile flag (i.e., run the install step as "bun install --frozen-lockfile") so the job fails if the lockfile would be modified, ensuring reproducible builds and detecting drift between package files and the lockfile.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/continuous-integration.yml:
- Line 30: The workflow currently uses the unpinned action reference
oven-sh/setup-bun@v2 which is a supply-chain risk; update that reference to the
specific commit oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 so
the CI always uses the exact action version, replacing oven-sh/setup-bun@v2 with
the provided commit hash in the continuous-integration.yml step that references
the setup-bun action.
In `@package.json`:
- Line 139: There's a JSON syntax error from a trailing comma before a closing
array bracket in package.json; locate the array that ends with the lone "]" (the
property whose value is the array causing the trailing comma) and remove the
trailing comma immediately before that closing bracket so the array is valid
JSON (no code change beyond deleting the comma).
---
Outside diff comments:
In `@package.json`:
- Line 69: Remove the duplicate "`@types/ref-struct-di`" entry from the runtime
dependencies block and keep it only under devDependencies; edit package.json to
delete the "`@types/ref-struct-di`" line from the "dependencies" section (the one
shown in the diff) so type definitions remain exclusively in "devDependencies".
---
Duplicate comments:
In @.github/workflows/continuous-integration.yml:
- Line 35: Update the CI step that runs the package installation so it uses
Bun's frozen lockfile check: replace the current "run: bun install" invocation
with a command that adds the --frozen-lockfile flag (i.e., run the install step
as "bun install --frozen-lockfile") so the job fails if the lockfile would be
modified, ensuring reproducible builds and detecting drift between package files
and the lockfile.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 9babfa39-67c0-426f-a4d7-5e1354a29e71
⛔ Files ignored due to path filters (1)
bun.lockis excluded by!**/*.lock
📒 Files selected for processing (2)
.github/workflows/continuous-integration.ymlpackage.json
| cache: 'yarn' | ||
|
|
||
| - name: Setup bun | ||
| uses: oven-sh/setup-bun@v2 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Description: Fetch the commit hash for the v2 tag of oven-sh/setup-bun
gh api repos/oven-sh/setup-bun/git/ref/tags/v2 --jq '.object.sha' 2>/dev/null || \
gh api repos/oven-sh/setup-bun/commits?sha=v2 --jq '.[0].sha' 2>/dev/null || \
echo "Could not resolve v2 tag. Please check the repository manually."Repository: credebl/agent-controller
Length of output: 109
Pin the action to a specific commit hash.
The oven-sh/setup-bun action is not pinned to a commit, creating a supply chain security risk. Replace oven-sh/setup-bun@v2 with oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 to ensure the exact version is always used, preventing potential tag manipulation or unintended updates.
🧰 Tools
🪛 zizmor (1.25.2)
[error] 30-30: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/continuous-integration.yml at line 30, The workflow
currently uses the unpinned action reference oven-sh/setup-bun@v2 which is a
supply-chain risk; update that reference to the specific commit
oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 so the CI always uses
the exact action version, replacing oven-sh/setup-bun@v2 with the provided
commit hash in the continuous-integration.yml step that references the setup-bun
action.
| "@credo-ts/askar", | ||
| "@openwallet-foundation/askar-nodejs", | ||
| "@hyperledger/anoncreds-nodejs", | ||
| ] |
There was a problem hiding this comment.
Fix JSON syntax error: remove trailing comma.
JSON does not allow trailing commas. This will cause parsing errors when tools read package.json.
🐛 Proposed fix
- "`@hyperledger/anoncreds-nodejs`",
+ "`@hyperledger/anoncreds-nodejs`"📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| ] | |
| "`@hyperledger/anoncreds-nodejs`" | |
| ] |
🧰 Tools
🪛 Biome (2.4.15)
[error] 139-139: Expected an array, an object, or a literal but instead found ']'.
(parse)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@package.json` at line 139, There's a JSON syntax error from a trailing comma
before a closing array bracket in package.json; locate the array that ends with
the lone "]" (the property whose value is the array causing the trailing comma)
and remove the trailing comma immediately before that closing bracket so the
array is valid JSON (no code change beyond deleting the comma).
2 participants
What
Summary by CodeRabbit