Repository navigation
build: freeze the lockfile for every bun install - #234
Merged
Merged
Conversation
Bun does not switch to --frozen-lockfile under CI the way npm and pnpm do, so the plain `./bun install` in ci.yml, release.yml, and validate-packs.yml would silently re-resolve a drifted package.json against the live registry and build from versions the commit never pinned. Set frozenLockfile in bunfig.toml so every install (CI, release, local) fails loudly on drift instead. Intentional dep changes go through `bun add`/`bun remove` or `./bun install --no-frozen-lockfile`. Also commit the lockfile drift that was already present (workspace package versions 0.8.0 -> 0.9.0).
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
Both release helpers must synchronize and commit the lockfile after version bumps to avoid blocking subsequent frozen installs.
1 open issue
What changed in this PR
This PR makes frozen lockfile installs the repository default, helping CI and release builds use committed dependency resolutions.
Changes:
- Enable
install.frozenLockfileand document how to intentionally update dependencies. - Refresh workspace versions in
bun.lockto 0.9.0 or 0.9.1 without changing external dependency resolutions.
| File | Description |
|---|---|
bunfig.toml |
Enable frozen installs and document the override. |
bun.lock |
Synchronize workspace versions and remove extra blank lines. |
Review effort: Balanced
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Audit finding M7.
Bun does not auto-freeze the lockfile under
CI=true(npm and pnpm do).ci.yml,release.yml, andvalidate-packs.ymlall run plain./bun install, so a driftedpackage.jsonis silently re-resolved against the live npm registry and the release binaries / npm packages are built from versions the tagged commit never pinned, while provenance attests the commit SHA.Fix:
frozenLockfile = trueinbunfig.toml, so every install (CI, release, and local) fails on drift rather than rewritingbun.lock. This covers future workflows too; the explicit flags indocs.ymland the Dockerfile stay as harmless no-ops.Verified: with the setting in place, editing a dep range and running
./bun installexits 1 witherror: lockfile had changes, but lockfile is frozen. A clean tree installs normally.Also: commits the lockfile drift that was already present on
main(workspace package versions 0.8.0 → 0.9.0 inbun.lock), which is what kept rewritingbun.locklocally on./bun xruns.To change deps intentionally:
bun add/bun remove, or./bun install --no-frozen-lockfile, then commitbun.lock.