ci: use bun for filesystem validation workflow

Author: shtse8

.doctrine/project.json

@@ -109,18 +109,11 @@
     "recoveryClass": "forward-fix-only",
     "packageRelease": {
       "publishesPackages": true,
-      "ecosystems": [
-        "npm",
-        "docker-hub",
-        "github-release",
-        "changesets"
-      ],
+      "ecosystems": ["npm", "docker-hub", "github-release", "changesets"],
       "releaseIntent": "Changesets and version tags capture package/image release intent.",
       "versionPr": "Changesets version changes and release workflow evidence must precede publish.",
       "publisher": "GitHub Actions publish workflow with NPM_TOKEN and Docker Hub credentials.",
-      "requiredContexts": [
-        "Validate Code Quality"
-      ],
+      "requiredContexts": ["Validate Code Quality"],
       "publishProof": "npm package readback, Docker Hub image tags, GitHub Release, and attached build artifact."
     }
   },

.github/workflows/publish.yml

@@ -32,31 +32,30 @@ jobs:
           # Optional: config-file: './.github/codeql/codeql-config.yml'
           # Optional: queries: '+security-extended'
 
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@v2
         with:
-          version: latest # Use the latest pnpm version
+          bun-version: '1.3.1'
 
       - name: Set up Node.js
         uses: actions/setup-node@v4.0.3
         with:
-          node-version: 'lts/*' # Use latest LTS
-          cache: 'pnpm' # Let pnpm handle caching via pnpm/action-setup
+          node-version: '22.14'
 
       - name: Install dependencies # Correct install step
-        run: pnpm install --frozen-lockfile
+        run: bun install --frozen-lockfile
 
-      - name: Check for vulnerabilities # Added pnpm audit
-        run: pnpm audit --prod # Check only production dependencies
+      - name: Check for vulnerabilities
+        run: bun audit
 
       - name: Check Formatting
-        run: pnpm run check-format # Fails job if check fails
+        run: bun run check-format # Fails job if check fails
 
       - name: Lint Code
-        run: pnpm run lint # Fails job if lint fails
+        run: bun run lint # Fails job if lint fails
 
       - name: Run Tests and Check Coverage
-        run: pnpm run test:cov # Fails job if tests fail or coverage threshold not met
+        run: bun run test:cov # Fails job if tests fail or coverage threshold not met
 
       - name: Upload coverage to Codecov
         uses: codecov/codecov-action@v4.5.0 # Use Codecov action with fixed version
@@ -95,23 +94,22 @@ jobs:
         uses: actions/checkout@v5.0.0
       # Removed incorrect CodeQL init from here
 
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@v2
         with:
-          version: latest
+          bun-version: '1.3.1'
 
       - name: Set up Node.js
         uses: actions/setup-node@v4.0.3
         with:
-          node-version: 'lts/*' # Use latest LTS
-          registry-url: 'https://registry.npmjs.org/' # For pnpm publish
-          cache: 'pnpm' # Let pnpm handle caching
+          node-version: '22.14'
+          registry-url: 'https://registry.npmjs.org/' # For npm publish
 
       - name: Install dependencies
-        run: pnpm install --frozen-lockfile
+        run: bun install --frozen-lockfile
 
       - name: Build project
-        run: pnpm run build
+        run: bun run build
 
       - name: Get package version from tag
         id: get_version
@@ -143,25 +141,24 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v5.0.0
 
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@v2
         with:
-          version: latest
+          bun-version: '1.3.1'
 
       - name: Set up Node.js for NPM
         uses: actions/setup-node@v4.0.3
         with:
-          node-version: 'lts/*'
+          node-version: '22.14'
           registry-url: 'https://registry.npmjs.org/'
-          cache: 'pnpm'
 
       # No need to install dependencies again if publish doesn't need them
-      # If pnpm publish needs package.json, it's checked out
+      # If package publish needs package.json, it's checked out
       - name: Install all dependencies for prepublishOnly script
-        run: pnpm install --frozen-lockfile
+        run: bun install --frozen-lockfile
 
       - name: Publish to npm
-        run: pnpm changeset publish
+        run: bun run changeset:publish
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}