[hedinasr]

BUILD-13251: Add a config-bun action so Bun projects resolve npm packages from Repox the same way the other config-* actions do, instead of each repo fetching readers and selecting registries inline.

• Registry selection: uses the shared repox-url default, so SaaS on GitHub-hosted runners and the production Edge on self-hosted runners. It fetches the matching Vault reader with the same role and engine logic as config-npm and config-uv.
• Environment variables: exports BUN_CONFIG_REGISTRY and BUN_CONFIG_TOKEN, plus ARTIFACTORY_USERNAME and ARTIFACTORY_ACCESS_TOKEN. Bun applies these after bunfig.toml and .npmrc, so they replace the default registry and token those files set (.npmrc support).
• Lockfile: the action does not modify bun.lock. Bun downloads locked packages from the absolute tarball URLs in bun.lock and writes registry-relative entries only for registry.npmjs.org (oven-sh/bun#45250). Consumers must commit a bun.lock resolved through the same Repox as repox-url. The README documents this.
• Caching: caches ~/.bun/install/cache, keyed on bun.lock. disable-caching: true turns it off.
• Out of scope: it does not install Bun, run bun ci, or claim a build number.

Test plan:

• In sonarqube-cli run 40478890642, sonarqube-cli#1111's setup-bun called config-bun@feat/hnasr/BUILD-13251-configBun with repox-url: https://repox-internal.sonar.build, and its bun.lock pins tarballs to the production Edge.

  • Unit Tests - windows on a self-hosted WarpBuild runner resolved from the Edge:

    Dependency registry: https://repox-internal.sonar.build/artifactory/api/npm/npm/
    288 packages installed [13.28s]
    

  • Sign and Notarize macOS Binaries on a GitHub-hosted macOS runner reached the Edge through Cloudflare WARP (288 packages installed [11.81s]).

  • Lint, Linux unit tests and Build All Binaries also passed with the Edge reader.

• Shellspec: 4 examples pass. They cover the registry and token export, the GitHub Actions log group, and failure without a reader token.

[hashicorp-vault-sonar-prod]

BUILD-13251

[gitar-bot]

Code Review ✅ Approved 2 closed / 2 findings

🟡 Medium risk · The new config-bun action exports Repox reader credentials to workflow steps, which could expose package access if a consuming workflow mishandles them.

Adds a config-bun action that fetches the matching Vault reader and exports BUN_CONFIG_REGISTRY, BUN_CONFIG_TOKEN, ARTIFACTORY_USERNAME and ARTIFACTORY_ACCESS_TOKEN so Bun resolves npm packages from Repox. Resolved the missing npm credentials alongside NPM_CONFIG_REGISTRY, and the PR description was corrected to drop the bun.lock normalization promise that this commit removed. No issues remain open.

✅ 2 closed

✅ Edge Case: NPM_CONFIG_REGISTRY points npm at Repox with no npm credentials

📄 config-bun/bun_config.sh:24-36 📄 README.md:1548
configure_bun_registry exports NPM_CONFIG_REGISTRY set to the Repox npm registry, and the README says it is there "for npm-compatible tools". The token only reaches Bun, though, through BUN_CONFIG_TOKEN. Nothing writes the //<host>/artifactory/api/npm/:_authToken= entry that config-npm/npm_config.sh puts in ~/.npmrc. So any later npm/npx step in a job that only calls config-bun gets moved from its usual registry to Repox and sends no credentials. Repox reads are authenticated, which is why config-npm always writes the token, so those calls fail with 401. Either drop the NPM_CONFIG_REGISTRY export, or also write the matching _authToken line to ~/.npmrc the way config-npm does.

✅ Quality: PR description still promises bun.lock normalization this commit removed

📄 README.md:1493-1494 📄 config-bun/action.yml 📄 config-bun/bun_config.sh
The PR description still says normalize-lockfile: true rewrites absolute SaaS, Edge and dev Edge tarball URLs in bun.lock to registry-relative ones by default. It also says the rewrite is idempotent, tolerates a missing lockfile, and warns when it changes the file. This commit removes the normalize-lockfile input from config-bun/action.yml, the rewrite logic from bun_config.sh, and the matching specs and README row. The README now asks users to commit a bun.lock resolved through the same Repox as repox-url. Anyone reading the description, including the reviewers of SonarSource/sonarqube-cli#1111, will expect lockfile rewriting that no longer happens. Update the description to drop the normalization constraints and describe the new requirement to commit a matching lockfile.

Verification Rules 2/2 met Repos 1 inspected

Functional validation No results

Rules 2 passed 1 not applicable

✅ Internal artifact registries
✅ Repository license compliance

Broader impact Repos 1 inspected

Cross-repo 1 repository inspected 0 open impacts

SonarSource/sonarqube-cli Inspected

Auto-approval Not enabled

Set up

_{For more verification details, comment gitar display:verbose.}

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing compact verification results.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues
0 New dependency risks

Measures
0 Security Hotspots
94.1% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud