build: replace pnpm with Bun

.github/scripts/check_plugin_source_compatibility.py

@@ -13,6 +13,7 @@
 MAX_SOURCE_FILE_BYTES = 150_000
 MAX_DEPENDENCY_LOCK_BYTES = 2_000_000
 DEPENDENCY_LOCK_NAMES = {
+    "bun.lock",
     "Cargo.lock",
     "package-lock.json",
     "pnpm-lock.yaml",

.github/scripts/test_check_plugin_source_compatibility.py

@@ -46,15 +46,16 @@ def test_reports_tracked_source_violations_in_stable_order(tmp_path: Path) -> No
     ]
 
 
-def test_accepts_valid_source_and_ignores_untracked_files(tmp_path: Path) -> None:
+@pytest.mark.parametrize("lock_name", ["package-lock.json", "bun.lock"])
+def test_accepts_valid_source_and_ignores_untracked_files(tmp_path: Path, lock_name: str) -> None:
     (tmp_path / "README.md").write_text("A complete sentence.\n", encoding="utf-8")
-    (tmp_path / "package-lock.json").write_bytes(b"x" * 150_001)
+    (tmp_path / lock_name).write_bytes(b"x" * 150_001)
     (tmp_path / "untracked.md").write_text(
         "This untracked prose continues\nonto another source line.\n",
         encoding="utf-8",
     )
     initialize_repository(tmp_path)
-    track(tmp_path, "README.md", "package-lock.json")
+    track(tmp_path, "README.md", lock_name)
 
     result = run_checker(tmp_path)
 
@@ -120,15 +121,16 @@ def test_accepts_wraps_adjacent_to_inline_markup(tmp_path: Path, content: str) -
     assert result.returncode == 0, result.stderr
 
 
-def test_rejects_dependency_lock_files_above_two_megabytes(tmp_path: Path) -> None:
-    (tmp_path / "pnpm-lock.yaml").write_bytes(b"x" * 2_000_001)
+@pytest.mark.parametrize("lock_name", ["pnpm-lock.yaml", "bun.lock"])
+def test_rejects_dependency_lock_files_above_two_megabytes(tmp_path: Path, lock_name: str) -> None:
+    (tmp_path / lock_name).write_bytes(b"x" * 2_000_001)
     initialize_repository(tmp_path)
-    track(tmp_path, "pnpm-lock.yaml")
+    track(tmp_path, lock_name)
 
     result = run_checker(tmp_path)
 
     assert result.returncode == 1
-    assert result.stderr == ("pnpm-lock.yaml: file is 2000001 bytes; maximum is 2000000 bytes\n")
+    assert result.stderr == f"{lock_name}: file is 2000001 bytes; maximum is 2000000 bytes\n"
 
 
 @pytest.mark.skipif(os.name == "nt", reason="creating symlinks requires elevated Windows access")

.github/workflows/node-ci.yml

@@ -87,14 +87,17 @@ jobs:
         run: |
           python .github/scripts/check_plugin_source_compatibility.py
 
-      - name: Set up pnpm
+      - name: Set up Bun
         if: steps.scope.outputs.check-markdown == 'true'
-        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
-          package_json_file: package.json
-          cache: true
-          cache_dependency_path: sdk/typescript/pnpm-lock.yaml
-
+          bun-version: "1.3.14"
+      - name: Cache Bun downloads
+        if: steps.scope.outputs.check-markdown == 'true'
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: ~/.bun/install/cache
+          key: ${{ runner.os }}-${{ runner.arch }}-bun-1.3.14-${{ hashFiles('sdk/typescript/bun.lock', 'plugins/codex-security/mcp-app/bun.lock') }}
       - name: Set up Node.js
         if: steps.scope.outputs.check-markdown == 'true'
         uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
@@ -103,7 +106,7 @@ jobs:
 
       - name: Install dependencies
         if: steps.scope.outputs.check-markdown == 'true'
-        run: pnpm --dir sdk/typescript install --frozen-lockfile
+        run: bun install --cwd sdk/typescript --frozen-lockfile
 
       - name: Check Markdown formatting
         if: steps.scope.outputs.check-markdown == 'true'
@@ -117,7 +120,7 @@ jobs:
             fi
           done < <(git diff --no-renames --name-only -z HEAD^1 HEAD)
           if ((${#files[@]} > 0)); then
-            pnpm --dir sdk/typescript exec prettier --check "${files[@]}"
+            bun run --cwd sdk/typescript prettier --check "${files[@]}"
           fi
 
   static-checks:
@@ -131,26 +134,27 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
-      - name: Set up pnpm
-        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
-        with:
-          package_json_file: package.json
-          cache: true
-          cache_dependency_path: |
-            sdk/typescript/pnpm-lock.yaml
-            plugins/codex-security/mcp-app/pnpm-lock.yaml
+      - name: Set up Bun
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+        with:
+          bun-version: "1.3.14"
+      - name: Cache Bun downloads
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: ~/.bun/install/cache
+          key: ${{ runner.os }}-${{ runner.arch }}-bun-1.3.14-${{ hashFiles('sdk/typescript/bun.lock', 'plugins/codex-security/mcp-app/bun.lock') }}
       - name: Set up Node.js
         uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
         with:
           node-version: "22.13.0"
       - name: Install dependencies
         run: |
-          pnpm --dir sdk/typescript install --frozen-lockfile
-          pnpm --dir plugins/codex-security/mcp-app install --frozen-lockfile
+          bun install --cwd sdk/typescript --frozen-lockfile
+          bun install --cwd plugins/codex-security/mcp-app --frozen-lockfile
       - name: Typecheck
-        run: pnpm --dir sdk/typescript run types
+        run: bun run --cwd sdk/typescript types
       - name: Check formatting
-        run: pnpm --dir sdk/typescript run format
+        run: bun run --cwd sdk/typescript format
 
   package:
     name: build and check package
@@ -165,28 +169,29 @@ jobs:
           persist-credentials: false
       - name: Check plugin source boundary
         run: node sdk/typescript/scripts/check-plugin-source.mjs
-      - name: Set up pnpm
-        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
-        with:
-          package_json_file: package.json
-          cache: true
-          cache_dependency_path: |
-            sdk/typescript/pnpm-lock.yaml
-            plugins/codex-security/mcp-app/pnpm-lock.yaml
+      - name: Set up Bun
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+        with:
+          bun-version: "1.3.14"
+      - name: Cache Bun downloads
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: ~/.bun/install/cache
+          key: ${{ runner.os }}-${{ runner.arch }}-bun-1.3.14-${{ hashFiles('sdk/typescript/bun.lock', 'plugins/codex-security/mcp-app/bun.lock') }}
       - name: Set up Node.js
         uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
         with:
           node-version: "22.13.0"
       - name: Install dependencies
         run: |
-          pnpm --dir sdk/typescript install --frozen-lockfile
-          pnpm --dir plugins/codex-security/mcp-app install --frozen-lockfile
+          bun install --cwd sdk/typescript --frozen-lockfile
+          bun install --cwd plugins/codex-security/mcp-app --frozen-lockfile
       - name: Audit production dependencies
         continue-on-error: true
-        run: pnpm --dir sdk/typescript run audit:prod
+        run: bun run --cwd sdk/typescript audit:prod
       - name: Pack
         working-directory: sdk/typescript
-        run: pnpm pack --pack-destination ../../dist
+        run: bun pm pack --destination ../../dist
       - name: Inspect archive contents
         working-directory: sdk/typescript
         run: node scripts/check-package.mjs ../../dist/*.tgz ../../plugins/codex-security/plugin-files.json
@@ -215,14 +220,6 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
-      - name: Set up pnpm
-        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
-        with:
-          package_json_file: package.json
-          cache: true
-          cache_dependency_path: |
-            sdk/typescript/pnpm-lock.yaml
-            plugins/codex-security/mcp-app/pnpm-lock.yaml
       - name: Set up Node.js
         uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
         with:
@@ -231,10 +228,15 @@ jobs:
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
           bun-version: "1.3.14"
+      - name: Cache Bun downloads
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: ~/.bun/install/cache
+          key: ${{ runner.os }}-${{ runner.arch }}-bun-1.3.14-${{ hashFiles('sdk/typescript/bun.lock', 'plugins/codex-security/mcp-app/bun.lock') }}
       - name: Install dependencies
         run: |
-          pnpm --dir sdk/typescript install --frozen-lockfile
-          pnpm --dir plugins/codex-security/mcp-app install --frozen-lockfile
+          bun install --cwd sdk/typescript --frozen-lockfile
+          bun install --cwd plugins/codex-security/mcp-app --frozen-lockfile
       - name: Download package for this commit
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
@@ -294,7 +296,7 @@ jobs:
         with:
           node-version: ${{ matrix.node }}
           cache: npm
-          cache-dependency-path: sdk/typescript/pnpm-lock.yaml
+          cache-dependency-path: sdk/typescript/bun.lock
       - name: Download package for this commit
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
@@ -315,18 +317,21 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
-      - name: Set up pnpm
-        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+      - name: Set up Bun
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+        with:
+          bun-version: "1.3.14"
+      - name: Cache Bun downloads
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
-          package_json_file: package.json
-          cache: true
-          cache_dependency_path: plugins/codex-security/mcp-app/pnpm-lock.yaml
+          path: ~/.bun/install/cache
+          key: ${{ runner.os }}-${{ runner.arch }}-bun-1.3.14-${{ hashFiles('sdk/typescript/bun.lock', 'plugins/codex-security/mcp-app/bun.lock') }}
       - name: Set up Node.js
         uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
         with:
           node-version: "22.13.0"
       - name: Install dependencies
-        run: pnpm --dir plugins/codex-security/mcp-app install --frozen-lockfile
+        run: bun install --cwd plugins/codex-security/mcp-app --frozen-lockfile
       - name: Install ripgrep
         run: |
           sudo apt-get update
@@ -339,7 +344,7 @@ jobs:
       - name: Restore bundled plugin
         run: tar -xzf dist/*.tgz --strip-components=1 -C sdk/typescript package/_bundled_plugin
       - name: Test MCP app
-        run: pnpm --dir plugins/codex-security/mcp-app run test:mcp
+        run: bun run --cwd plugins/codex-security/mcp-app test:mcp
       - name: Upload MCP test reports
         if: always()
         continue-on-error: true
@@ -441,18 +446,19 @@ jobs:
         uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
         with:
           node-version: "22.13.0"
-      - name: Set up pnpm
-        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
-        with:
-          package_json_file: package.json
       - name: Set up Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
           bun-version: "1.3.14"
+      - name: Cache Bun downloads
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: ~/.bun/install/cache
+          key: ${{ runner.os }}-${{ runner.arch }}-bun-1.3.14-${{ hashFiles('sdk/typescript/bun.lock', 'plugins/codex-security/mcp-app/bun.lock') }}
       - name: Install dependencies
         run: |
-          pnpm --dir sdk/typescript install --frozen-lockfile
-          pnpm --dir plugins/codex-security/mcp-app install --frozen-lockfile
+          bun install --cwd sdk/typescript --frozen-lockfile
+          bun install --cwd plugins/codex-security/mcp-app --frozen-lockfile
       - name: Download package for this commit
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
@@ -514,7 +520,7 @@ jobs:
         with:
           node-version: ${{ matrix.node }}
           cache: npm
-          cache-dependency-path: sdk/typescript/pnpm-lock.yaml
+          cache-dependency-path: sdk/typescript/bun.lock
       - name: Download package for this commit
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:

.github/workflows/node-release.yml

@@ -19,8 +19,6 @@ jobs:
       contents: read
     env:
       NPM_CONFIG_REGISTRY: https://openai.firewall.socket.dev/npm/
-      PNPM_CONFIG_REGISTRY: https://openai.firewall.socket.dev/npm/
-      COREPACK_NPM_REGISTRY: https://openai.firewall.socket.dev/npm/
       BUN_CONFIG_REGISTRY: https://openai.firewall.socket.dev/npm/
     outputs:
       artifact-id: ${{ steps.upload.outputs.artifact-id }}
@@ -56,9 +54,6 @@ jobs:
           {
             printf 'NPM_CONFIG_REGISTRY=%s\n' "$npm_registry"
             printf 'npm_config_registry=%s\n' "$npm_registry"
-            printf 'PNPM_CONFIG_REGISTRY=%s\n' "$npm_registry"
-            printf 'pnpm_config_registry=%s\n' "$npm_registry"
-            printf 'COREPACK_NPM_REGISTRY=%s\n' "$npm_registry"
             printf 'YARN_NPM_REGISTRY_SERVER=%s\n' "$npm_registry"
             printf 'BUN_CONFIG_REGISTRY=%s\n' "$npm_registry"
             printf 'UV_DEFAULT_INDEX=%s\n' "$pypi_registry"
@@ -72,10 +67,6 @@ jobs:
           bun-version: "1.3.14"
           no-cache: true
 
-      - name: Enable pnpm
-        shell: bash
-        run: corepack enable && corepack prepare "$(node -p 'require("./package.json").packageManager')" --activate
-
       - name: Validate release tag
         id: release
         shell: bash
@@ -135,8 +126,8 @@ jobs:
 
       - name: Install dependencies
         run: |
-          sfw pnpm --dir sdk/typescript install --frozen-lockfile
-          sfw pnpm --dir plugins/codex-security/mcp-app install --frozen-lockfile
+          sfw bun install --cwd sdk/typescript --frozen-lockfile
+          sfw bun install --cwd plugins/codex-security/mcp-app --frozen-lockfile
 
       - name: Install ripgrep
         run: |
@@ -145,29 +136,29 @@ jobs:
 
       - name: Audit production dependencies
         continue-on-error: true
-        run: sfw pnpm --dir sdk/typescript run audit:prod
+        run: sfw bun run --cwd sdk/typescript audit:prod
 
       - name: Verify
         run: |
-          pnpm --dir sdk/typescript run types
-          pnpm --dir sdk/typescript run test
-          pnpm --dir sdk/typescript run test:mcp
-          pnpm --dir sdk/typescript run format
+          bun run --cwd sdk/typescript types
+          bun run --cwd sdk/typescript test
+          bun run --cwd sdk/typescript test:mcp
+          bun run --cwd sdk/typescript format
 
       - name: Pack
         working-directory: sdk/typescript
         shell: bash
         run: |
           set -euo pipefail
           npm pkg set "gitHead=$GITHUB_SHA"
-          pnpm pack --pack-destination ../../dist
+          bun pm pack --destination ../../dist
 
       - name: Inspect package
         working-directory: sdk/typescript
         shell: bash
         env:
           CODEX_SECURITY_EXPECTED_GIT_HEAD: ${{ github.sha }}
-        run: pnpm run check:package ../../dist/*.tgz
+        run: bun run check:package ../../dist/*.tgz
 
       - name: Recover the published npm release archive
         if: steps.release.outputs.mode == 'recover'