From 103cbb419eed7e26d8e656dacf7ba23bdcda2447 Mon Sep 17 00:00:00 2001
From: Bryan Helmkamp <bryan@brynary.com>
Date: Fri, 21 Aug 2026 06:43:38 -0400
Subject: [PATCH] Pin Bun to 1.3.14 in CI and release workflows

setup-bun installed the latest Bun at run time, so every job floated to
new Bun releases the day they shipped. Bun bundles the SPA embedded in
release binaries, so an unvetted Bun release could break or silently
change shipped artifacts. Pin to 1.3.14, the version the last green
nightly used, and hold off on the day-old 1.4.0 until it has soaked.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 .github/workflows/nightly.yml    | 1 +
 .github/workflows/release.yml    | 1 +
 .github/workflows/typescript.yml | 6 ++++++
 3 files changed, 8 insertions(+)

diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
index 4140f576b..b5469bf9f 100644
--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@@ -45,6 +45,7 @@ jobs:
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
         if: steps.skip.outputs.skip != 'true'
         with:
+          bun-version: 1.3.14
           no-cache: true
 
       - name: Install bun deps (for SPA verify)
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 522d1a311..a643070f0 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -49,6 +49,7 @@ jobs:
 
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
         with:
+          bun-version: 1.3.14
           no-cache: true
 
       - name: Install bun deps
diff --git a/.github/workflows/typescript.yml b/.github/workflows/typescript.yml
index 450b88d97..f2086669e 100644
--- a/.github/workflows/typescript.yml
+++ b/.github/workflows/typescript.yml
@@ -44,6 +44,8 @@ jobs:
         with:
           persist-credentials: false
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
+        with:
+          bun-version: 1.3.14
       - run: bun install --frozen-lockfile
       - run: cd apps/fabro-web && bun run typecheck
       - run: cd lib/packages/fabro-api-client && bun run typecheck
@@ -58,6 +60,8 @@ jobs:
         with:
           persist-credentials: false
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
+        with:
+          bun-version: 1.3.14
       - run: bun install --frozen-lockfile
       - run: cd apps/fabro-web && bun run test
 
@@ -71,6 +75,8 @@ jobs:
         with:
           persist-credentials: false
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
+        with:
+          bun-version: 1.3.14
       - run: bun install --frozen-lockfile
       - uses: dtolnay/rust-toolchain@631a55b12751854ce901bb631d5902ceb48146f7 # stable
         with: