From 7059c90cb645b150ff7a6f04fa6ab73695634dd4 Mon Sep 17 00:00:00 2001 From: "Ricardo Q. Bazan" Date: Sun, 18 Oct 2026 11:18:08 -0500 Subject: [PATCH] ci: install the dependency audit's bun with mise Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_017sXwJhk5oRMrzxnA1zWxER --- .github/workflows/dependency-audit.yml | 16 ++++---- mise.audit.lock | 52 ++++++++++++++++++++++++++ mise.audit.toml | 6 +++ 3 files changed, 66 insertions(+), 8 deletions(-) create mode 100644 mise.audit.lock create mode 100644 mise.audit.toml diff --git a/.github/workflows/dependency-audit.yml b/.github/workflows/dependency-audit.yml index 77f14d6..6029d45 100644 --- a/.github/workflows/dependency-audit.yml +++ b/.github/workflows/dependency-audit.yml @@ -22,6 +22,9 @@ jobs: permissions: contents: read issues: write + # Adds mise.audit.toml (locked in mise.audit.lock): the bun that runs `bun audit`. + env: + MISE_ENV: audit steps: - name: ⬇️ Checkout repo uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 @@ -69,14 +72,11 @@ jobs: audit "examples/ssr-react-router/pnpm-lock.yaml" pnpm -C examples/ssr-react-router audit --ignore-workspace audit "examples/ssr-tanstack-start/pnpm-lock.yaml" pnpm -C examples/ssr-tanstack-start audit --ignore-workspace audit "examples/worker-cloudflare/pnpm-lock.yaml" pnpm -C examples/worker-cloudflare audit --ignore-workspace - # `bun audit` needs bun >= 1.2.15, but the bun examples pin bun 1.2.4 on purpose, and mise's - # locked mode refuses a bun that is not in their mise.lock. So run bun from npm through the - # root pnpm (exact version, checked against the registry integrity), from inside each - # example so it reads that example's bun.lock. `pnpm dlx` ignores the workspace's - # minimumReleaseAge, so the same 24 h cooldown is passed explicitly. - # The absolute path keeps mise's shims from resolving the example's own tools. - pnpm_bin="$(mise which pnpm)" - bun_audit() { (cd "$1" && "$pnpm_bin" --config.minimum-release-age=1440 dlx bun@1.4.3 audit); } + # `bun audit` needs bun >= 1.2.15, but the bun examples pin bun 1.2.4 on purpose. So run the + # root's audit bun (mise.audit.toml), from inside each example so it reads that example's + # bun.lock. The absolute path keeps mise from resolving the example's own bun there. + bun_bin="$(mise which bun)" + bun_audit() { (cd "$1" && "$bun_bin" audit); } audit "examples/backend-bun/bun.lock" bun_audit examples/backend-bun audit "examples/backend-bun-cjs/bun.lock" bun_audit examples/backend-bun-cjs audit "examples/backend-deno/bun.lock" bun_audit examples/backend-deno diff --git a/mise.audit.lock b/mise.audit.lock new file mode 100644 index 0000000..dd0bfbe --- /dev/null +++ b/mise.audit.lock @@ -0,0 +1,52 @@ +# @generated - this file is auto-generated by `mise lock` https://mise.jdx.dev/dev-tools/mise-lock.html + +lockfile_version = 3 + +[[tools.bun]] +version = "1.4.3" +backend = "core:bun" +specifiers = ["1.4.3"] + +[tools.bun."platforms.linux-arm64"] +checksum = "sha256:efa9813da5ed72423bf847f916e8d2c47c0d776add972354026a75e10da9aa21" +url = "https://github.com/oven-sh/bun/releases/download/bun-v1.4.3/bun-linux-aarch64.zip" + +[tools.bun."platforms.linux-arm64-musl"] +checksum = "sha256:8de8a0003cc2707bb555887e3d450e24e1edf3f605f491393e89ed61a8853420" +url = "https://github.com/oven-sh/bun/releases/download/bun-v1.4.3/bun-linux-aarch64-musl.zip" + +[tools.bun."platforms.linux-x64"] +checksum = "sha256:3e730528d89775f03f87f05c06787c4df4099d0a37f3f252e7b829cb23816e18" +url = "https://github.com/oven-sh/bun/releases/download/bun-v1.4.3/bun-linux-x64.zip" + +[tools.bun."platforms.linux-x64-baseline"] +checksum = "sha256:1fc2edac843102909e3a1be1d8d9802cc6071cf074e67e88231f4ffe0f8b397b" +url = "https://github.com/oven-sh/bun/releases/download/bun-v1.4.3/bun-linux-x64-baseline.zip" + +[tools.bun."platforms.linux-x64-musl"] +checksum = "sha256:6e9ea98554ea0d05efda5840ae292618aaa3adefd66b0853520c5c86a37eac9c" +url = "https://github.com/oven-sh/bun/releases/download/bun-v1.4.3/bun-linux-x64-musl.zip" + +[tools.bun."platforms.linux-x64-musl-baseline"] +checksum = "sha256:4b5b0b5503f6ebf15161e8c56eb5a263134c05cd98a86dc11ee43ac5bda9862e" +url = "https://github.com/oven-sh/bun/releases/download/bun-v1.4.3/bun-linux-x64-musl-baseline.zip" + +[tools.bun."platforms.macos-arm64"] +checksum = "sha256:80afd4c069b46a6fa8f3ec520bebc750a7843e4a8d5b9583d29ad436c00a3403" +url = "https://github.com/oven-sh/bun/releases/download/bun-v1.4.3/bun-darwin-aarch64.zip" + +[tools.bun."platforms.macos-x64"] +checksum = "sha256:62660e6438eb872278877acca77e1152d5d031324df368d4a81b428211489d2d" +url = "https://github.com/oven-sh/bun/releases/download/bun-v1.4.3/bun-darwin-x64.zip" + +[tools.bun."platforms.macos-x64-baseline"] +checksum = "sha256:0fde04e8b092156b97fe6432e899baf16d9ed6ce52cbb4218d2d9c07a2f827ef" +url = "https://github.com/oven-sh/bun/releases/download/bun-v1.4.3/bun-darwin-x64-baseline.zip" + +[tools.bun."platforms.windows-x64"] +checksum = "sha256:0bf84e808552beea67bf1202a287a35c6c825d837b287b3f8e9dd513dba35d3d" +url = "https://github.com/oven-sh/bun/releases/download/bun-v1.4.3/bun-windows-x64.zip" + +[tools.bun."platforms.windows-x64-baseline"] +checksum = "sha256:d7a7d3eb216614544aab0cde2d8d9f2e4e87839bf5a30a1cd11d077f02d84e0c" +url = "https://github.com/oven-sh/bun/releases/download/bun-v1.4.3/bun-windows-x64-baseline.zip" diff --git a/mise.audit.toml b/mise.audit.toml new file mode 100644 index 0000000..ef3d71d --- /dev/null +++ b/mise.audit.toml @@ -0,0 +1,6 @@ +# The bun that the weekly dependency audit runs: `bun audit` needs bun >= 1.2.15, and the bun +# examples pin 1.2.4 on purpose. `MISE_ENV=audit` adds it to the root tools, as the audit does. +# To bump it, pick a release at least 24 h old, then run +# `MISE_ENV=audit mise lock -p linux-x64,linux-x64-musl,linux-arm64,linux-arm64-musl,macos-x64,macos-arm64,windows-x64 bun`. +[tools] +bun = "1.4.3"