Skip to content

feat: add bun to controller #387

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
sujitaw wants to merge 8 commits into
base: main
Choose a base branch
from
+2,635 −16
Open

feat: add bun to controller #387

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
ebc5f92
feat: add bun to controller
sujitaw May 19, 2026
840b1bf
fix: pr comments code rabbit
sujitaw May 19, 2026
31aeb8d
fix: update CI workflow to remove develop branch references and bun l…
KambleSahil3 May 19, 2026
710e6f2
fix: ensure bun version is specified in CI workflow
KambleSahil3 May 19, 2026
e8cf5b6
chore: format continuous integration workflow
KambleSahil3 May 19, 2026
0eb8f07
fix: update prettier script to use bunx for consistent formatting
KambleSahil3 May 19, 2026
7168c6a
fix/errors while doing issuance
sujitaw May 20, 2026
35c92f2
Merge branch 'feat/add_bun_for_controller' of https://github.com/cred…
sujitaw May 20, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 13 additions & 7 deletions .github/workflows/continuous-integration.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,9 +2,11 @@ name: Continuous Integration

on:
pull_request:
branches: [main, develop]
branches:
- main
push:
branches: [main, develop]
branches:
- main

concurrency:
# Cancel previous runs that are not completed yet
Expand All @@ -23,16 +25,20 @@ jobs:
uses: actions/setup-node@v4
with:
node-version: 20
cache: 'yarn'

- name: Setup bun
uses: oven-sh/setup-bun@v2
Copy link
Copy Markdown

@coderabbitai coderabbitai Bot May 20, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Description: Fetch the commit hash for the v2 tag of oven-sh/setup-bun

gh api repos/oven-sh/setup-bun/git/ref/tags/v2 --jq '.object.sha' 2>/dev/null || \
gh api repos/oven-sh/setup-bun/commits?sha=v2 --jq '.[0].sha' 2>/dev/null || \
echo "Could not resolve v2 tag. Please check the repository manually."

Repository: credebl/agent-controller

Length of output: 109

Pin the action to a specific commit hash.

The oven-sh/setup-bun action is not pinned to a commit, creating a supply chain security risk. Replace oven-sh/setup-bun@v2 with oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 to ensure the exact version is always used, preventing potential tag manipulation or unintended updates.

🧰 Tools
🪛 zizmor (1.25.2)

[error] 30-30: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/continuous-integration.yml at line 30, The workflow
currently uses the unpinned action reference oven-sh/setup-bun@v2 which is a
supply-chain risk; update that reference to the specific commit
oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 so the CI always uses
the exact action version, replacing oven-sh/setup-bun@v2 with the provided
commit hash in the continuous-integration.yml step that references the setup-bun
action.

with:
bun-version: 1.3.3

- name: Install dependencies
run: yarn install
run: bun install
Copy link
Copy Markdown

@coderabbitai coderabbitai Bot May 19, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Use --frozen-lockfile flag for reproducible CI builds.

The bun install command should include the --frozen-lockfile flag in CI environments to ensure reproducible builds and catch any drift between package.json and the lockfile.

🔒 Proposed fix to add frozen lockfile flag 
 - name: Install dependencies
-  run: bun install
+  run: bun install --frozen-lockfile
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
run: bun install
run: bun install --frozen-lockfile
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/continuous-integration.yml at line 33, Update the CI step
that runs the package install so it uses a frozen lockfile: change the run
command that currently invokes "bun install" to include the "--frozen-lockfile"
flag (i.e., "bun install --frozen-lockfile") so the workflow step invoking bun
install will fail on lockfile drift and produce reproducible builds.


- name: Linting
run: yarn lint
run: bun lint

- name: Prettier
run: yarn check-format
run: bun check-format

- name: Compile
run: yarn check-types
run: bun check-types
Loading
Loading