build(deps): migrate all JavaScript tooling to Bun

[FelixTJDietrich]

Description

Migrate all repository-owned JavaScript and TypeScript tooling from the split pnpm/Node/Bun setup to Bun 1.4.0. Bun now manages dependencies and runs Vite, Vitest, Storybook, Playwright, Docusaurus, release tooling, CI scripts, and Docker builds; shipped application behavior and operator configuration are unchanged.

This migration keeps the repository's existing reproducibility and supply-chain guarantees:

• package.json#packageManager is the authoritative Bun version, consumed by CI and checked against both Dockerfiles;
• installs use the isolated linker, a frozen text lockfile, a three-day minimum release age, explicit peer behavior, registry-only dependencies, and a minimal lifecycle-script allowlist;
• CI checks nested override resolutions and runs 25 clean frozen installs on Linux x64 and arm64 without permitting bun.lock to change;
• Docker downloads the exact official Bun release and verifies architecture-specific SHA-256 checksums;
• documentation deployment uses the locked Surge dependency instead of resolving executable code through bunx at deploy time;
• repository policy rejects pnpm workspace files, Node engine declarations, and Node/tsx package scripts.

Compatibility work is intentionally narrow: custom Oxlint rules are tested through the real native CLI and registered repository plugin. Small patches keep Zod compatible with the tracked Vitest/Bun ESM interoperability issue, normalize Storybook file URLs for Bun, and update gray-matter to js-yaml’s current API. The decision, trade-offs, and rollback procedure are documented in ADR 0033.

GitHub's pinned JavaScript actions still run on GitHub's action host. That control-plane runtime is outside the repository-owned runtime boundary.

Fixes #1469

How to test

bun install --frozen-lockfile
bun run format
bun run check
bun run test:webapp
bun run build:webapp
bun run docs:build
bun run --filter webapp build-storybook
scripts/qualify-bun-lockfile.sh 25

Validated locally on Linux x64:

• the complete repository check passes after a clean frozen install;
• all 1,149 webapp tests pass under Bun: 981 application tests and 168 custom Oxlint rule tests;
• the webapp, Storybook, and documentation production builds pass;
• 25 clean frozen installs preserve nested override versions and leave bun.lock byte-identical.

CI also passed Linux x64 and arm64 determinism qualification, all application and browser test jobs, security scans, CodeQL, documentation builds, and the application, webapp, and agent Docker builds. The initially failed server verification retry was caused by a transient Maven Central HTTP 429 while downloading Maven; the retry passed without a code change.

Checklist

• My changeset summary reads as an operator/user-facing note (it becomes the changelog entry) — see .changeset/README.md
• If the operator must act on this change (new required env var, manual migration step), the changeset summary says how (**Operators:** …) and MIGRATION.md is updated

The changeset is intentionally empty because this changes contributor and build infrastructure only. No operator action or migration entry is required.

[coderabbitai]

Important

Review skipped

Too many files!

This PR contains 120 files, which is 20 over the limit of 100.

To get a review, reduce the PR to 100 files or fewer by splitting it into smaller PRs or changing its base branch.

Upgrade to a paid plan to raise the limit.

This review couldn't start because sufficient usage credits or metered capacity aren't available. Add credits or update usage-based reviews in the billing tab, then retry.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 8e1e2c79-045b-439a-b516-6fc89945edce

📥 Commits

Reviewing files that changed from the base of the PR and between 44b3e32 and 2a6152c.

⛔ Files ignored due to path filters (2)

• bun.lock is excluded by !**/*.lock
• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (120)

• .agents/skills/fix-ci/SKILL.md
• .agents/skills/land-pr/SKILL.md
• .changeset/README.md
• .changeset/modern-bun-package-manager.md
• .claude/skills/fix-ci/SKILL.md
• .claude/skills/land-pr/SKILL.md
• .claude/skills/react-best-practices/AGENTS.md
• .claude/skills/react-best-practices/rules/rendering-svg-precision.md
• .claude/skills/storybook-components/RUBRIC.md
• .claude/skills/storybook-components/SKILL.md
• .claude/skills/storybook-components/traps.md
• .github/PULL_REQUEST_TEMPLATE.md
• .github/actions/setup-bun/action.yml
• .github/actions/setup-caches/action.yml
• .github/actions/setup-pnpm-node/action.yml
• .github/labeler.yml
• .github/scripts/label-pr.ts
• .github/workflows/cd-docs-teardown.yml
• .github/workflows/cd-docs.yml
• .github/workflows/ci-compose-validate.yml
• .github/workflows/ci-profile.yml
• .github/workflows/ci-quality-gates.yml
• .github/workflows/ci-tests.yml
• .github/workflows/cicd.yml
• .github/workflows/openapi-autocommit.yml
• .github/workflows/pull-request.yml
• .github/workflows/qualify-bun-lockfile.yml
• .github/workflows/security-mutation.yml
• .github/workflows/verify-changesets.yml
• .github/workflows/version-pr.yml
• .gitignore
• .husky/commit-msg
• .husky/pre-push
• .node-version
• .npmrc
• .trivyignore
• AGENTS.md
• CONTRIBUTING.md
• bunfig.toml
• docker/agents/pi/Dockerfile
• docs/.markdownlint-cli2.jsonc
• docs/README.md
• docs/admin/production-setup.mdx
• docs/admin/runtime-roles.mdx
• docs/contributor/agent/workspace-abi.mdx
• docs/contributor/ai-agent-workflow.mdx
• docs/contributor/ci-cd.mdx
• docs/contributor/coding-guidelines.mdx
• docs/contributor/database-migration.mdx
• docs/contributor/database-schema.mdx
• docs/contributor/e2e-testing.md
• docs/contributor/erd/schema.mmd
• docs/contributor/local-development.mdx
• docs/contributor/release-management.mdx
• docs/contributor/security-mutation-testing.md
• docs/contributor/sync-lifecycle.md
• docs/contributor/testing.mdx
• docs/decisions/0001-flat-top-level-layout.md
• docs/decisions/0008-webhook-runtime-role.md
• docs/decisions/0030-agent-runtime-is-typescript-on-bun.md
• docs/decisions/0033-bun-is-the-javascript-runtime-and-package-manager.md
• docs/decisions/README.md
• docs/docusaurus.config.ts
• docs/package.json
• docs/sidebars.ts
• mprocs.yaml
• package.json
• patches/gray-matter@4.0.3.patch
• patches/storybook@10.4.0.patch
• patches/zod@4.4.3.patch
• pnpm-workspace.yaml
• renovate.json
• scripts/README.md
• scripts/check-agent-instructions.ts
• scripts/check-agent-runtime-pins.ts
• scripts/check-env-defaults.ts
• scripts/check-env-roles.ts
• scripts/check-java-nullness.ts
• scripts/check-mermaid-diagrams.ts
• scripts/check-package-manager.ts
• scripts/check-presentational-components.ts
• scripts/check-story-prose.ts
• scripts/check-story-sort.ts
• scripts/db-utils.sh
• scripts/generate-mermaid-erd.ts
• scripts/jean-public-test.sh
• scripts/jean-setup.sh
• scripts/nats-extract-examples.ts
• scripts/qualify-bun-lockfile.sh
• scripts/run-mvnw.ts
• scripts/tsconfig.json
• scripts/types/jsdom.d.ts
• scripts/update-gitlab-schema.ts
• server/AGENTS.md
• server/application/src/main/java/de/tum/cit/aet/hephaestus/feature/FeatureFlag.java
• server/application/src/main/java/de/tum/cit/aet/hephaestus/integration/core/oauth/state/HmacOAuthStateService.java
• server/application/src/main/resources/agent/pi-runner-usage.ts
• server/application/src/main/resources/practices/default-catalog.json
• server/application/src/main/resources/practices/precompute/changes-dependencies-deliberately.ts
• server/application/src/test/java/de/tum/cit/aet/hephaestus/agent/mentor/live/MentorLiveLlmTest.java
• server/application/src/test/java/de/tum/cit/aet/hephaestus/agent/mentor/live/MentorSandboxStressTest.java
• server/application/src/test/java/de/tum/cit/aet/hephaestus/agent/practice/live/PracticeRunnerLiveLlmTest.java
• server/application/src/test/java/de/tum/cit/aet/hephaestus/agent/sandbox/docker/interactive/DockerInteractiveSandboxLiveTest.java
• server/compose.yaml
• tsconfig.agents.json
• webapp/.oxlintrc.json
• webapp/AGENTS.md
• webapp/Dockerfile
• webapp/README.md
• webapp/e2e/README.md
• webapp/e2e/fixtures.ts
• webapp/e2e/urls.ts
• webapp/package.json
• webapp/playwright.config.ts
• webapp/public/env-config.js
• webapp/scripts/export-readme-assets.ts
• webapp/src/mocks/server.ts
• webapp/tools/oxlint/rule-tester.ts
• webapp/tsconfig.json
• webapp/vitest.config.storybook.ts

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

📚 Documentation Preview

Preview has been removed (PR closed)