Skip to content

feat: add bun to controller#387

Open
sujitaw wants to merge 6 commits into
mainfrom
feat/add_bun_for_controller
Open

feat: add bun to controller#387
sujitaw wants to merge 6 commits into
mainfrom
feat/add_bun_for_controller

Conversation

@sujitaw
Copy link
Copy Markdown
Contributor

@sujitaw sujitaw commented May 19, 2026

What

  • added bun package manager for credo controller.

Summary by CodeRabbit

Chores

  • Switched development, build, and validation tooling to an alternative runtime for improved performance and consistency.
  • Updated CI workflow to align with the new tooling and streamline install/lint/format/type-check steps.
  • Adjusted CI branch triggers to focus on the primary release branch.
  • Added a top-level trusted dependency configuration to improve build security and stability.

Review Change Stack

Signed-off-by: sujitaw <sujit.sutar@ayanworks.com>
@sujitaw sujitaw self-assigned this May 19, 2026
@coderabbitai
Copy link
Copy Markdown

coderabbitai Bot commented May 19, 2026

Warning

Rate limit exceeded

@KambleSahil3 has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 46 minutes and 56 seconds before requesting another review.

You’ve run out of usage credits. Purchase more in the billing tab.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: c6de359c-1a78-4e9f-ac72-db5d5b7598a5

📥 Commits

Reviewing files that changed from the base of the PR and between 31aeb8d and 0eb8f07.

📒 Files selected for processing (2)
  • .github/workflows/continuous-integration.yml
  • package.json
📝 Walkthrough

Walkthrough

Update scripts and CI to use Bun (replacing Yarn commands) and add a top-level trustedDependencies array listing native-module-related packages and patch-package.

Changes

Package Manager and Dependency Configuration

Layer / File(s) Summary
Build and script migration to bun
package.json
Script commands including format, check-format, build, prestart:dev, start:dev, prepublishOnly, and validate are changed to use bun.
CI workflow migration to bun
.github/workflows/continuous-integration.yml
CI steps and branch filter switched from Yarn/develop to Bun/main (bun install, bun lint, bun check-format, bun check-types).
Native dependency trust configuration
package.json
Adds trustedDependencies array whitelisting patch-package and native-module packages (node-gyp-build, @2060.io/*, @hyperledger/indy-vdr-nodejs, @credo-ts/askar, @openwallet-foundation/askar-nodejs).

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Poem

🐰 Bun in paws, scripts leap and run,
Yarn tiptoes off beneath the sun.
Native roots get a trustful nod,
Patch and builds now hop abroad. 🥕✨

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 inconclusive)

Check name Status Explanation Resolution
Title check ❓ Inconclusive The title 'feat: add bun to controller' is vague and overly generic. While 'bun' appears in the changeset, the title doesn't clearly explain what adding bun actually entails—switching package manager across scripts, CI workflows, and configuration. Use a more descriptive title like 'feat: migrate package manager from yarn to bun' or 'feat: switch to bun for build scripts and CI' to clearly communicate the main scope of changes.
✅ Passed checks (4 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch feat/add_bun_for_controller

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

Copy link
Copy Markdown

@coderabbitai coderabbitai Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@package.json`:
- Line 39: The validate script currently mixes package managers ("validate") by
calling bun lint && yarn check-types && yarn check-format; update it to use bun
consistently by invoking the other scripts via bun (e.g., replace the yarn calls
with bun run check-types and bun run check-format) and ensure the referenced
scripts check-types and check-format exist in package.json so all parts of
"validate" use bun only.
- Around line 26-39: Update CI/CD and project files to complete the yarn→bun
migration: modify the workflow referenced by continuous-integration.yml to
change cache: 'yarn' → 'bun' (or remove), replace `yarn install` with `bun
install`, and change `yarn lint`, `yarn check-format`, `yarn check-types` to
`bun lint`, `bun check-format`, `bun check-types`; update .github/dependabot.yml
to rename the 'yarn' label to 'bun'; remove yarn.lock and ensure bun.lockb is
generated and committed; and update developer setup docs/README to document
using bun so scripts like the package.json "validate" (which currently runs `bun
lint && yarn check-types && yarn check-format`) and other scripts
("format","check-format","lint","validate","dev","build") consistently use bun
commands.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 7d0b27ac-8d92-4340-bae5-468f17c4090d

📥 Commits

Reviewing files that changed from the base of the PR and between 3116c1a and ebc5f92.

⛔ Files ignored due to path filters (1)
  • bun.lock is excluded by !**/*.lock
📒 Files selected for processing (1)
  • package.json

Comment thread package.json Outdated
Comment thread package.json Outdated
Signed-off-by: sujitaw <sujit.sutar@ayanworks.com>
Copy link
Copy Markdown

@coderabbitai coderabbitai Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)
.github/workflows/continuous-integration.yml (1)

22-29: ⚠️ Potential issue | 🔴 Critical | ⚡ Quick win

Add explicit Bun installation and fix cache configuration.

actions/setup-node does not install Bun—it only sets up Node.js. Line 29 will fail with bun: command not found. Additionally, cache: 'bun' is not supported by setup-node; it only supports npm, yarn, and pnpm.

Proposed fix
      - name: Setup node v20
        uses: actions/setup-node@v4
        with:
          node-version: 20
-         cache: 'bun'

+      - name: Setup Bun
+        uses: oven-sh/setup-bun@v2
+
+      - name: Cache Bun dependencies
+        uses: actions/cache@v4
+        with:
+          path: ~/.bun/install/cache
+          key: bun-${{ runner.os }}-${{ hashFiles('bun.lockb') }}
+          restore-keys: bun-${{ runner.os }}-
+
       - name: Install dependencies
         run: bun install
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/continuous-integration.yml around lines 22 - 29, The
workflow uses actions/setup-node with cache: 'bun' and then runs "bun install",
which fails because setup-node doesn't provide Bun and its cache option doesn't
support 'bun'; update the "Setup node v20" step to remove or change the
unsupported cache value (use supported values like 'npm'/'yarn'/'pnpm' or omit),
and add an explicit Bun installation step before the "Install dependencies" step
(either use an official setup action such as actions/setup-bun or run a short
install script to install Bun), ensuring the "Install dependencies" step still
runs "bun install" after Bun is available.
🧹 Nitpick comments (1)
.github/workflows/continuous-integration.yml (1)

29-29: ⚡ Quick win

Use a frozen lockfile in CI installs for deterministic builds.

On Line 29, prefer bun install --frozen-lockfile so CI fails on lockfile drift instead of silently changing dependency resolution.

Proposed fix
-      - name: Install dependencies
-        run: bun install
+      - name: Install dependencies
+        run: bun install --frozen-lockfile
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/continuous-integration.yml at line 29, Update the CI
install step that currently runs "bun install" to use a frozen lockfile by
changing the command to "bun install --frozen-lockfile" so the workflow fails on
lockfile drift instead of mutating dependencies; locate the run step that
executes bun install in the continuous integration workflow and replace the
command accordingly.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Outside diff comments:
In @.github/workflows/continuous-integration.yml:
- Around line 22-29: The workflow uses actions/setup-node with cache: 'bun' and
then runs "bun install", which fails because setup-node doesn't provide Bun and
its cache option doesn't support 'bun'; update the "Setup node v20" step to
remove or change the unsupported cache value (use supported values like
'npm'/'yarn'/'pnpm' or omit), and add an explicit Bun installation step before
the "Install dependencies" step (either use an official setup action such as
actions/setup-bun or run a short install script to install Bun), ensuring the
"Install dependencies" step still runs "bun install" after Bun is available.

---

Nitpick comments:
In @.github/workflows/continuous-integration.yml:
- Line 29: Update the CI install step that currently runs "bun install" to use a
frozen lockfile by changing the command to "bun install --frozen-lockfile" so
the workflow fails on lockfile drift instead of mutating dependencies; locate
the run step that executes bun install in the continuous integration workflow
and replace the command accordingly.

ℹ️ Review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 8e6fcb5f-edd3-4578-8cfd-3757351446f4

📥 Commits

Reviewing files that changed from the base of the PR and between ebc5f92 and 840b1bf.

📒 Files selected for processing (2)
  • .github/workflows/continuous-integration.yml
  • package.json
🚧 Files skipped from review as they are similar to previous changes (1)
  • package.json

…int issues

Signed-off-by: KambleSahil3 <sahil.kamble@ayanworks.com>
Copy link
Copy Markdown

@coderabbitai coderabbitai Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🧹 Nitpick comments (1)
.github/workflows/continuous-integration.yml (1)

29-30: ⚡ Quick win

Consider pinning the bun version for reproducibility.

The setup step doesn't specify a bun-version, which means CI will use the latest available version. This could lead to unexpected failures if a new bun release introduces breaking changes.

📌 Proposed fix to pin the bun version
 - name: Setup bun
   uses: oven-sh/setup-bun@v2
+  with:
+    bun-version: latest

Or pin to a specific version for maximum reproducibility:

 - name: Setup bun
   uses: oven-sh/setup-bun@v2
+  with:
+    bun-version: 1.1.0
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/continuous-integration.yml around lines 29 - 30, The CI
step using the GitHub Action "Setup bun" (uses: oven-sh/setup-bun@v2) should pin
a specific bun version by adding the bun-version input (e.g., bun-version:
"1.5.0" or a tested semantic version) to the action configuration so the
workflow uses a fixed, reproducible bun release instead of the latest.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/continuous-integration.yml:
- Line 33: Update the CI step that runs the package install so it uses a frozen
lockfile: change the run command that currently invokes "bun install" to include
the "--frozen-lockfile" flag (i.e., "bun install --frozen-lockfile") so the
workflow step invoking bun install will fail on lockfile drift and produce
reproducible builds.

---

Nitpick comments:
In @.github/workflows/continuous-integration.yml:
- Around line 29-30: The CI step using the GitHub Action "Setup bun" (uses:
oven-sh/setup-bun@v2) should pin a specific bun version by adding the
bun-version input (e.g., bun-version: "1.5.0" or a tested semantic version) to
the action configuration so the workflow uses a fixed, reproducible bun release
instead of the latest.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 0d639cef-821f-4292-b4b1-4ddb1b923664

📥 Commits

Reviewing files that changed from the base of the PR and between 840b1bf and 31aeb8d.

📒 Files selected for processing (1)
  • .github/workflows/continuous-integration.yml


- name: Install dependencies
run: yarn install
run: bun install
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Use --frozen-lockfile flag for reproducible CI builds.

The bun install command should include the --frozen-lockfile flag in CI environments to ensure reproducible builds and catch any drift between package.json and the lockfile.

🔒 Proposed fix to add frozen lockfile flag
 - name: Install dependencies
-  run: bun install
+  run: bun install --frozen-lockfile
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
run: bun install
run: bun install --frozen-lockfile
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/continuous-integration.yml at line 33, Update the CI step
that runs the package install so it uses a frozen lockfile: change the run
command that currently invokes "bun install" to include the "--frozen-lockfile"
flag (i.e., "bun install --frozen-lockfile") so the workflow step invoking bun
install will fail on lockfile drift and produce reproducible builds.

Signed-off-by: KambleSahil3 <sahil.kamble@ayanworks.com>
Signed-off-by: KambleSahil3 <sahil.kamble@ayanworks.com>
Signed-off-by: KambleSahil3 <sahil.kamble@ayanworks.com>
@sonarqubecloud
Copy link
Copy Markdown

Quality Gate Failed Quality Gate failed

Failed conditions
1 Security Hotspot

See analysis details on SonarQube Cloud

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants