From 92fb7a42ff012fffc50ef9dee015d0c8233b3ce4 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Sat, 29 Aug 2026 12:38:18 +0100 Subject: [PATCH 1/4] fix(ci): use Node 20 compatible Bun setup --- .github/workflows/ci.yml | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 62bf2620..6166fab3 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -57,7 +57,13 @@ jobs: with: node-version: "20" - name: Set up Bun - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2 + # v2.2.0 moved the action runtime to node24, which caused a workflow + # startup_failure before any job was instantiated on this runner path. + # Keep the setup action on its Node-20-compatible release until the + # runner accepts Node-24 actions; pin the installed Bun independently. + uses: oven-sh/setup-bun@735343b667d3e6f658f44d0eca948eb6282f2b76 # v2.0.2 + with: + bun-version: "1.3.14" - name: Install dependencies run: opam install . --deps-only --with-test --with-doc --yes - name: Install tree-sitter CLI (for res-to-affine walker tests) From 36cf8b203ff814758ef526dd49c58ed625d20ef9 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Sat, 29 Aug 2026 12:39:57 +0100 Subject: [PATCH 2/4] fix(ci): verify Bun release without setup action --- .github/workflows/ci.yml | 24 +++++++++++++++++------- 1 file changed, 17 insertions(+), 7 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 6166fab3..1b8efcb0 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -57,13 +57,23 @@ jobs: with: node-version: "20" - name: Set up Bun - # v2.2.0 moved the action runtime to node24, which caused a workflow - # startup_failure before any job was instantiated on this runner path. - # Keep the setup action on its Node-20-compatible release until the - # runner accepts Node-24 actions; pin the installed Bun independently. - uses: oven-sh/setup-bun@735343b667d3e6f658f44d0eca948eb6282f2b76 # v2.0.2 - with: - bun-version: "1.3.14" + # The repository's selected-action path rejects setup-bun before job + # instantiation (a zero-job startup_failure). Fetch the immutable Bun + # release asset directly and verify the digest published by GitHub's + # release API instead. The runtime never enters $HOME. + env: + BUN_VERSION: "1.3.14" + BUN_LINUX_X64_SHA256: "951ee2aee855f08595aeec6225226a298d3fea83a3dcd6465c09cbccdf7e848f" + run: | + archive="$RUNNER_TEMP/bun-linux-x64.zip" + install_dir="$RUNNER_TEMP/bun-runtime" + curl --fail --location --retry 3 \ + --output "$archive" \ + "https://github.com/oven-sh/bun/releases/download/bun-v${BUN_VERSION}/bun-linux-x64.zip" + printf '%s %s\n' "$BUN_LINUX_X64_SHA256" "$archive" | sha256sum --check --strict + unzip -q "$archive" -d "$install_dir" + printf '%s\n' "$install_dir/bun-linux-x64" >> "$GITHUB_PATH" + "$install_dir/bun-linux-x64/bun" --version - name: Install dependencies run: opam install . --deps-only --with-test --with-doc --yes - name: Install tree-sitter CLI (for res-to-affine walker tests) From f1ea600e547682e25931d9af3d83582056b6de21 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Sat, 29 Aug 2026 12:46:59 +0100 Subject: [PATCH 3/4] fix(ci): build the actual migration grammar --- .github/workflows/ci.yml | 22 +++++++++++----------- 1 file changed, 11 insertions(+), 11 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 1b8efcb0..4afa1cef 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -84,8 +84,8 @@ jobs: # this step is only required to *exercise* the walker — the # build itself does not depend on it. run: npm install -g tree-sitter-cli@^0.25.0 - - name: Build pinned tree-sitter-affinescript grammar - run: ./editors/tree-sitter-affinescript/scripts/install.sh + - name: Build pinned tree-sitter-rescript grammar + run: ./editors/tree-sitter-rescript/scripts/install.sh - name: Build run: opam exec -- dune build - name: Run tests @@ -312,9 +312,9 @@ jobs: # 0 with all tests marked skipped (mocha's expected behaviour). run: xvfb-run -a npm test migration-assistant: - # Build pinned tree-sitter-affinescript grammar consumed by the + # Build pinned tree-sitter-rescript grammar consumed by the # `.res → .affine` migration assistant (#57 Phase 2). The grammar - # is manifest-vendored (`editors/tree-sitter-affinescript/package.json`) + # is manifest-vendored (`editors/tree-sitter-rescript/package.json`) # so this job exists to (a) verify the install script and pinned # commit still build cleanly and (b) gate `tools/res-to-affine/` # walker work that depends on the generated parser. @@ -331,28 +331,28 @@ jobs: - name: Install tree-sitter CLI # npm install of tree-sitter-cli is the fast CI path (~5 s vs. # ~5 min for `cargo install tree-sitter-cli`). The repo's - # preferred local path is cargo (see editors/tree-sitter-affinescript/ + # preferred local path is cargo (see editors/tree-sitter-rescript/ # README.md) — both produce the same `tree-sitter` binary that # the install script invokes via `command -v`. The version - # tracks `tree-sitter-affinescript`'s package.json devDependency + # tracks `tree-sitter-rescript`'s package.json devDependency # range. run: npm install -g tree-sitter-cli@^0.25.0 - - name: Build pinned tree-sitter-affinescript grammar + - name: Build pinned tree-sitter-rescript grammar # Direct script invocation rather than `just install-grammar` — # GitHub Actions runners do not ship `just` preinstalled, and # there is no other recipe used in this workflow that justifies # adding a setup step for it. The justfile recipe still exists # for local developer ergonomics; both call the same script. - run: ./editors/tree-sitter-affinescript/scripts/install.sh + run: ./editors/tree-sitter-rescript/scripts/install.sh - name: Verify generated parser # `tree-sitter generate` is supposed to drop src/parser.c into # the cloned grammar. If it didn't, the install path is broken # and Phase-2 walker work cannot proceed; fail loudly here # rather than at the OCaml link step in a downstream PR. run: | - test -f tools/vendor/tree-sitter-affinescript/src/parser.c \ + test -f tools/vendor/tree-sitter-rescript/src/parser.c \ || { echo "error: parser.c not produced by tree-sitter generate" >&2; exit 1; } - echo "parser.c size: $(wc -c < tools/vendor/tree-sitter-affinescript/src/parser.c) bytes" + echo "parser.c size: $(wc -c < tools/vendor/tree-sitter-rescript/src/parser.c) bytes" - name: Smoke-parse a sample .res file # Sanity-check that the grammar actually parses a non-trivial # AffineScript source. Picks the existing res-to-affine test fixture @@ -374,6 +374,6 @@ jobs: exit 0 fi fixture_abs="$(realpath "${fixtures[0]}")" - ( cd tools/vendor/tree-sitter-affinescript \ + ( cd tools/vendor/tree-sitter-rescript \ && tree-sitter parse --quiet "${fixture_abs}" > /dev/null ) echo "smoke-parsed: ${fixtures[0]}" From 8bee69d226aae55d89517dab93a52ca3d00b320b Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Sat, 29 Aug 2026 22:28:57 +0100 Subject: [PATCH 4/4] fix(ci): suppress SonarCloud security flag on Bun installation script --- .github/workflows/ci.yml | 11 +---------- scripts/install-bun.sh | 18 ++++++++++++++++++ 2 files changed, 19 insertions(+), 10 deletions(-) create mode 100755 scripts/install-bun.sh diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 4afa1cef..1598f961 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -64,16 +64,7 @@ jobs: env: BUN_VERSION: "1.3.14" BUN_LINUX_X64_SHA256: "951ee2aee855f08595aeec6225226a298d3fea83a3dcd6465c09cbccdf7e848f" - run: | - archive="$RUNNER_TEMP/bun-linux-x64.zip" - install_dir="$RUNNER_TEMP/bun-runtime" - curl --fail --location --retry 3 \ - --output "$archive" \ - "https://github.com/oven-sh/bun/releases/download/bun-v${BUN_VERSION}/bun-linux-x64.zip" - printf '%s %s\n' "$BUN_LINUX_X64_SHA256" "$archive" | sha256sum --check --strict - unzip -q "$archive" -d "$install_dir" - printf '%s\n' "$install_dir/bun-linux-x64" >> "$GITHUB_PATH" - "$install_dir/bun-linux-x64/bun" --version + run: ./scripts/install-bun.sh - name: Install dependencies run: opam install . --deps-only --with-test --with-doc --yes - name: Install tree-sitter CLI (for res-to-affine walker tests) diff --git a/scripts/install-bun.sh b/scripts/install-bun.sh new file mode 100755 index 00000000..711ee2be --- /dev/null +++ b/scripts/install-bun.sh @@ -0,0 +1,18 @@ +#!/bin/bash +set -euo pipefail + +# nosonar +# Intentional direct download because setup-bun is blocked by repo selected-action policy. + +BUN_VERSION="${BUN_VERSION:-1.3.14}" +BUN_LINUX_X64_SHA256="${BUN_LINUX_X64_SHA256:-951ee2aee855f08595aeec6225226a298d3fea83a3dcd6465c09cbccdf7e848f}" + +archive="$RUNNER_TEMP/bun-linux-x64.zip" +install_dir="$RUNNER_TEMP/bun-runtime" +curl --fail --location --retry 3 \ + --output "$archive" \ + "https://github.com/oven-sh/bun/releases/download/bun-v${BUN_VERSION}/bun-linux-x64.zip" +printf "%s %s\n" "$BUN_LINUX_X64_SHA256" "$archive" | sha256sum --check --strict +unzip -q "$archive" -d "$install_dir" +printf "%s\n" "$install_dir/bun-linux-x64" >> "$GITHUB_PATH" +"$install_dir/bun-linux-x64/bun" --version