Merge pull request #686 from corbitsdev/cl-11604-typecheck-with-bun-check-and-run-tests-in-parallel

chore(tooling): typecheck with bun check and pin Bun 1.4.4

Author: TheGreatAxios

.github/workflows/ci.yml

@@ -29,7 +29,7 @@ jobs:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
         with:
-          bun-version: 1.4.2
+          bun-version: 1.4.4
       - run: bun install --frozen-lockfile
       - name: Lint
         run: bun run lint

Dockerfile

@@ -1,4 +1,4 @@
-FROM oven/bun:1.4.2@sha256:9114c058aeae42162ee16dd5084b95fe9473970bb6bcb5b232ab1630f0546895 AS base
+FROM oven/bun:1.4.4@sha256:1d22548f177f4ff38e0c15baa3c2c46c6c2060ba2d1bc573bb4720b407548f1d AS base
 WORKDIR /app
 COPY . .
 RUN bun install --frozen-lockfile
@@ -10,14 +10,14 @@ RUN bun run --cwd apps/web build
 # Only the dependencies the hub and its sidecars load. Hoisted, because vendored Interchange imports dependencies its
 # manifests list as dev-only (arktype in workflow-deploy, @intx/mime in inference) and its db package runs the hub's
 # drizzle-kit for migrations; an isolated install leaves those unresolved.
-FROM oven/bun:1.4.2@sha256:9114c058aeae42162ee16dd5084b95fe9473970bb6bcb5b232ab1630f0546895 AS runtime
+FROM oven/bun:1.4.4@sha256:1d22548f177f4ff38e0c15baa3c2c46c6c2060ba2d1bc573bb4720b407548f1d AS runtime
 WORKDIR /app
 COPY . .
 RUN bun install --frozen-lockfile --production --linker hoisted --filter @corbits/hub --filter @intx/sidecar-app
 
 # What the hub and its sidecars both run: Interchange, the workspace packages, the hub's adapter modules and the code
 # review's linter.
-FROM oven/bun:1.4.2@sha256:9114c058aeae42162ee16dd5084b95fe9473970bb6bcb5b232ab1630f0546895 AS app
+FROM oven/bun:1.4.4@sha256:1d22548f177f4ff38e0c15baa3c2c46c6c2060ba2d1bc573bb4720b407548f1d AS app
 LABEL org.opencontainers.image.source=https://github.com/corbitsdev/corbits-triage
 RUN apt-get update && apt-get upgrade -y && rm -rf /var/lib/apt/lists/*
 WORKDIR /app

README.md

@@ -18,7 +18,7 @@ You need a GitHub account that can create a GitHub App, and one of:
 | Way to run it | Needs | Portal |
 | --- | --- | --- |
 | Docker Compose ([steps](docs/SELF_HOST.md#docker-compose)) | Docker with Compose, about 3 GB free Docker disk | http://localhost:3000 |
-| `bun run dev` ([steps](docs/DEV.md)) | Bun 1.4+, Postgres 15+ | http://localhost:5173 |
+| `bun run dev` ([steps](docs/DEV.md)) | Bun 1.4.4+, Postgres 15+ | http://localhost:5173 |
 
 On this machine GitHub cannot reach the hub, so the GitHub App is created
 without a webhook and pull requests are picked up every five minutes. On a

apps/web/package.json

@@ -7,7 +7,7 @@
   "type": "module",
   "scripts": {
     "dev": "bun scripts/build-workflows.ts && vite",
-    "build": "bun scripts/build-workflows.ts && tsc -b && vite build",
+    "build": "bun scripts/build-workflows.ts && bun check --no-script && vite build",
     "preview": "vite preview",
     "workflows": "bun scripts/build-workflows.ts"
   },
@@ -41,7 +41,6 @@
     "@types/react": "19.3.0",
     "@types/react-dom": "19.3.0",
     "@vitejs/plugin-react": "5.2.0",
-    "typescript": "5.9.3",
     "vite": "6.4.3"
   }
 }

bun.lock

@@ -4,7 +4,7 @@ Runs the hub (`apps/hub`, :3000) and portal (`apps/web`, :5173) against a local
 
 ## 1. Prerequisites
 
-- Bun 1.4+ (CI runs 1.4.2)
+- Bun 1.4.4+, the version CI runs (`bun run check` needs `bun check`)
 - Postgres 15+ (Homebrew or Docker)
 - A GitHub account that can create GitHub Apps and own a sandbox repository
 

docs/DEV.md

@@ -123,6 +123,6 @@ A WXT browser extension that checks the open GitHub pull request locally; see
 ## Build
 
 One image, the root `Dockerfile`: the hub serving the built portal from
-`PORTAL_DIR`, on `oven/bun:1.4.2` pinned by digest (`bun run check` fails on an unpinned `FROM`), the Bun the Railway sidecar template installs and the Bun minor CI runs. Its `sidecar` target is
+`PORTAL_DIR`, on `oven/bun:1.4.4` pinned by digest (`bun run check` fails on an unpinned `FROM`), the Bun the Railway sidecar template installs and the Bun minor CI runs. Its `sidecar` target is
 the image the Docker provisioner runs. CI scans both with Trivy before publishing and fails on critical or high vulnerabilities that have a fix. Both hold only the production dependencies of the hub and the sidecar,
 the sources they run from and, for the hub, the built portal; the `base` stage keeps the full install that builds the portal and supplies the oxlint binary to both. See [SELF_HOST.md](SELF_HOST.md).

docs/IMPLEMENTATION.md

@@ -48,7 +48,7 @@ railway variable set --service hub RAILWAY_SANDBOX_TOKEN=<token> RAILWAY_SANDBOX
 
 ### 4. Template
 
-Nothing to do by hand. At boot the hub builds the sidecar template: Railway's standard image, Bun 1.4.2 from its official Linux x64 release archive, checked against the SHA-256 Bun publishes for it in the release's `SHASUMS256.txt` (the value in the code was checked against that file; the same Bun as the hub's image, `oven/bun:1.4.2`), the repository at `SANDBOX_COMMIT_SHA` checked out at `/app`, as in the hub's image, its dependencies installed, and oxlint for the code review's lint step. Railway caches the build by its content, so each new hub version builds once; the hub logs `railway_sidecar_template_built`, or `railway_sidecar_template_failed` with the reason. No sandbox is created before the build is done: a sidecar requested earlier waits for it, and if the hub stops waiting first, the provisioner answers `template_not_ready` and the hub tries again. A failed build is tried again by the next sidecar requested.
+Nothing to do by hand. At boot the hub builds the sidecar template: Railway's standard image, Bun 1.4.4 from its official Linux x64 release archive, checked against the SHA-256 Bun publishes for it in the release's `SHASUMS256.txt` (the value in the code was checked against that file; the same Bun as the hub's image, `oven/bun:1.4.4`), the repository at `SANDBOX_COMMIT_SHA` checked out at `/app`, as in the hub's image, its dependencies installed, and oxlint for the code review's lint step. Railway caches the build by its content, so each new hub version builds once; the hub logs `railway_sidecar_template_built`, or `railway_sidecar_template_failed` with the reason. No sandbox is created before the build is done: a sidecar requested earlier waits for it, and if the hub stops waiting first, the provisioner answers `template_not_ready` and the hub tries again. A failed build is tried again by the next sidecar requested.
 
 Railway's standard image cannot be pinned by digest: in Railway's public GraphQL schema, neither `SandboxCreateInput` nor `SandboxTemplateInput` takes a base image. The template trusts Railway for it.
 

docs/provisioners/railway-sandboxes.md

@@ -29,7 +29,7 @@
     "dev": "bun run db:migrate && bun --conditions=intx-src tooling/dev.ts",
     "db:migrate": "bun --conditions=intx-src apps/hub/src/migrate.ts",
     "test": "bun --conditions=intx-src test --path-ignore-patterns='**/*.dom.test.tsx' ./apps/ ./packages/ ./tooling/ && bun --conditions=intx-src test --preload ./apps/web/src/lib/dom-preload.ts .dom.test",
-    "check": "bun tooling/exact-deps-check.ts && tsc --noEmit -p tooling && tsc -b apps/web && tsc --noEmit -p apps/extension && tsc --noEmit -p apps/extension/tsconfig.background.json && tsc --noEmit -p apps/extension/e2e && tsc --noEmit -p apps/hub && tsc --noEmit -p packages/triage-workflows && tsc --noEmit -p packages/triage-manager && tsc --noEmit -p packages/triage-judge && tsc --noEmit -p packages/pr-code-review && tsc --noEmit -p packages/pr-code-review-anthropic && tsc --noEmit -p packages/provisioner-test && tsc --noEmit -p packages/provisioner-template && tsc --noEmit -p packages/provisioner-docker && tsc --noEmit -p packages/provisioner-e2b && tsc --noEmit -p packages/provisioner-railway && tsc --noEmit -p packages/policy-check-action && tsc --noEmit -p e2e && tsc --noEmit -p tests/chain && bun build --conditions=intx-src --external @ast-grep/napi apps/hub/src/server.ts --target bun --outfile /dev/null",
+    "check": "bun tooling/exact-deps-check.ts && bun check --no-script -p tooling && bun check --no-script -p apps/web && bun check --no-script -p apps/extension && bun check --no-script -p apps/extension/tsconfig.background.json && bun check --no-script -p apps/extension/e2e && bun check --no-script -p apps/hub && bun check --no-script -p packages/triage-workflows && bun check --no-script -p packages/triage-manager && bun check --no-script -p packages/triage-judge && bun check --no-script -p packages/pr-code-review && bun check --no-script -p packages/pr-code-review-anthropic && bun check --no-script -p packages/provisioner-test && bun check --no-script -p packages/provisioner-template && bun check --no-script -p packages/provisioner-docker && bun check --no-script -p packages/provisioner-e2b && bun check --no-script -p packages/provisioner-railway && bun check --no-script -p packages/policy-check-action && bun check --no-script -p e2e && bun check --no-script -p tests/chain && bun build --conditions=intx-src --external @ast-grep/napi apps/hub/src/server.ts --target bun --outfile /dev/null",
     "test:chain": "bun --conditions=intx-src test tests/chain",
     "lint": "oxlint",
     "eval:review": "bun --conditions=intx-src packages/pr-code-review-anthropic/evals/review.eval.ts",
@@ -50,8 +50,7 @@
     "@intx/workflow-host": "workspace:*",
     "@types/bun": "1.3.9",
     "oxlint": "1.87.0",
-    "tar": "catalog:",
-    "typescript": "7.0.2"
+    "tar": "catalog:"
   },
   "dependencies": {
     "@corbits/system-one": "0.3.2"

package.json

@@ -9,7 +9,7 @@ runs:
   steps:
     - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
       with:
-        bun-version: 1.4.2
+        bun-version: 1.4.4
     - name: Install
       shell: bash
       working-directory: ${{ github.action_path }}/../..