Move the frontend from pnpm and Node to Bun

.github/renovate.json5

@@ -1,14 +1,26 @@
 // Renovate (GitHub App, https://github.com/apps/renovate): a pull request for each new release of
-// what Keybund builds on, plus the "Dependency Dashboard" issue listing what is open. Only Tauri
+// what Keybund builds on, plus the "Dependency Dashboard" issue listing what is open. Tauri
 // with tauri-specta (the typed commands in app/src/lib/bindings.ts): the crates and the npm
-// packages in one PR. OpenSSH and Git are the user's.
+// packages in one PR; and Bun (`packageManager` in app/package.json). OpenSSH and Git are the
+// user's.
 // Everything else (the other packages, the actions, the images) comes with the shared settings of
 // firsttris/workflows (renovate/default.json5): minor and patch updates once a month in one pull
 // request that merges itself when CI is green, majors on request in the dashboard.
-// Check with `npx --package renovate renovate-config-validator .github/renovate.json5`.
+// Check with `bunx --package renovate renovate-config-validator .github/renovate.json5`.
 {
   $schema: "https://docs.renovatebot.com/renovate-schema.json",
   extends: ["github>firsttris/workflows//renovate/default.json5"],
+  customManagers: [
+    {
+      // "packageManager": "bun@x.y.z" in app/package.json: the Bun of every workflow (setup-bun's
+      // bun-version-file, and npm in the Playwright image of the E2E and screenshots jobs)
+      customType: "regex",
+      managerFilePatterns: ["/^app/package\\.json$/"],
+      matchStrings: ['"packageManager": "bun@(?<currentValue>\\d+\\.\\d+\\.\\d+)"'],
+      depNameTemplate: "bun",
+      datasourceTemplate: "npm",
+    },
+  ],
   packageRules: [
     {
       // Tauri and tauri-specta: the crates and the npm packages in one PR, since the CLI wants
@@ -55,5 +67,19 @@
       matchPackageNames: ["specta-typescript"],
       allowedVersions: "<=0.0.13",
     },
+    {
+      // Bun installs the packages and runs the scripts and the Playwright runner; its own PR,
+      // majors too
+      matchPackageNames: ["bun"],
+      enabled: true,
+      groupName: "Bun",
+      sourceUrl: "https://github.com/oven-sh/bun",
+      prBodyNotes: [
+        "`packageManager` in `app/package.json` is the Bun of every workflow (setup-bun's `bun-version-file`, and `npm install bun@…` in the Playwright image of the E2E and screenshots jobs). Run `bun install` in `app/` in case `bun.lock` changes; CI's frontend and E2E jobs must be green (`bun run lint`, `typecheck`, `coverage`, `build`, `bun --bun playwright test`). Try `bun run tauri build` in a `release.yml` run on this branch.",
+      ],
+      schedule: ["at any time"],
+      automerge: false,
+      dependencyDashboardApproval: false,
+    },
   ],
 }

.github/workflows/ci.yml

@@ -118,19 +118,14 @@ jobs:
         working-directory: app
     steps:
       - uses: actions/checkout@v7
-      - uses: pnpm/action-setup@v6
+      - uses: oven-sh/setup-bun@v2
         with:
-          package_json_file: app/package.json
-      - uses: actions/setup-node@v7
-        with:
-          node-version: 26
-          cache: pnpm
-          cache-dependency-path: app/pnpm-lock.yaml
-      - run: pnpm install --frozen-lockfile
-      - run: pnpm lint
-      - run: pnpm typecheck
-      - run: pnpm coverage
-      - run: pnpm build
+          bun-version-file: app/package.json
+      - run: bun install --frozen-lockfile
+      - run: bun run lint
+      - run: bun run typecheck
+      - run: bun run coverage
+      - run: bun run build
       - uses: actions/upload-artifact@v7
         if: always()
         with:
@@ -149,7 +144,7 @@ jobs:
       - id: version
         uses: firsttris/workflows/actions/playwright-image@v1
         with:
-          lockfile: app/pnpm-lock.yaml
+          lockfile: app/bun.lock
 
   e2e:
     name: Frontend · Playwright E2E
@@ -166,16 +161,12 @@ jobs:
         working-directory: app
     steps:
       - uses: actions/checkout@v7
-      - uses: pnpm/action-setup@v6
-        with:
-          package_json_file: app/package.json
-      # Node comes with the image; this only caches the pnpm store.
-      - uses: actions/setup-node@v7
-        with:
-          cache: pnpm
-          cache-dependency-path: app/pnpm-lock.yaml
-      - run: pnpm install --frozen-lockfile
-      - run: pnpm e2e
+      # The npm package brings the binary without curl or unzip, which the image lacks; node reads
+      # the version (`packageManager` in app/package.json, as setup-bun takes it elsewhere), the
+      # image has no jq
+      - run: npm install --global "bun@$(node -p "require('./package.json').packageManager.split('@')[1]")"
+      - run: bun install --frozen-lockfile
+      - run: bun run e2e
       - uses: actions/upload-artifact@v7
         if: failure()
         with:

.github/workflows/release.yml

@@ -47,18 +47,13 @@ jobs:
           recommends: "false"
       - uses: dtolnay/rust-toolchain@stable
       - uses: Swatinem/rust-cache@v2
-      - uses: pnpm/action-setup@v6
+      - uses: oven-sh/setup-bun@v2
         with:
-          package_json_file: app/package.json
-      - uses: actions/setup-node@v7
-        with:
-          node-version: 26
-          cache: pnpm
-          cache-dependency-path: app/pnpm-lock.yaml
-      - run: pnpm install --frozen-lockfile
+          bun-version-file: app/package.json
+      - run: bun install --frozen-lockfile
         working-directory: app
       - run: cargo build --release --locked -p keybund-cli
-      - run: pnpm tauri build --bundles appimage,deb
+      - run: bun run tauri build --bundles appimage,deb
         working-directory: app
       - name: Collect release files
         run: |
@@ -86,15 +81,10 @@ jobs:
         with:
           targets: aarch64-apple-darwin, x86_64-apple-darwin
       - uses: Swatinem/rust-cache@v2
-      - uses: pnpm/action-setup@v6
-        with:
-          package_json_file: app/package.json
-      - uses: actions/setup-node@v7
+      - uses: oven-sh/setup-bun@v2
         with:
-          node-version: 26
-          cache: pnpm
-          cache-dependency-path: app/pnpm-lock.yaml
-      - run: pnpm install --frozen-lockfile
+          bun-version-file: app/package.json
+      - run: bun install --frozen-lockfile
         working-directory: app
       - name: CLI for both architectures in one binary
         run: |
@@ -107,7 +97,7 @@ jobs:
       # Ad-hoc signed ("signingIdentity": "-" in tauri.conf.json), not notarized: Gatekeeper asks
       # once, see docs/installation.md.
       # app too: the dmg alone keeps no .app around for the smoke test below.
-      - run: pnpm tauri build --target universal-apple-darwin --bundles app,dmg
+      - run: bun run tauri build --target universal-apple-darwin --bundles app,dmg
         working-directory: app
       # Nobody has to find out on their Mac that the app does not start: both architectures are in
       # it, the CLI answers, and the app opens its window and keeps running (a throw-away HOME,

.github/workflows/screenshots.yml

@@ -9,8 +9,13 @@ jobs:
   screenshots:
     uses: firsttris/workflows/.github/workflows/screenshots.yml@v1
     with:
-      install: npm install --global pnpm@10.28.0 && pnpm --dir app install --frozen-lockfile
-      lockfile: app/pnpm-lock.yaml
+      # The Bun of `packageManager` in app/package.json, as setup-bun takes it in ci.yml; the
+      # image has npm and node, but no unzip for Bun's installer and no jq (not the workflow's
+      # `bun-version` input, which would be a second place for the version)
+      install: >-
+        npm install --global "bun@$(node -p "require('./app/package.json').packageManager.split('@')[1]")"
+        && cd app && bun install --frozen-lockfile
+      lockfile: app/bun.lock
       command: bash scripts/screenshots.sh
       paths: |
         docs/screenshot-*.png