ci: pin supported Bun version across build and publish workflows

.github/workflows/ci.yml

@@ -37,7 +37,7 @@ jobs:
       - name: Setup Bun
         uses: oven-sh/setup-bun@v2
         with:
-          bun-version: latest
+          bun-version: 1.2.19
 
       - name: Install dependencies
         run: bun install --frozen-lockfile

.github/workflows/publish.yml

@@ -28,7 +28,7 @@ jobs:
       - name: Setup Bun
         uses: oven-sh/setup-bun@v2
         with:
-          bun-version: latest
+          bun-version: 1.2.2
 
       - name: Install dependencies
         run: bun install --frozen-lockfile

scripts/check-package-consumer.mjs

@@ -8,6 +8,9 @@ const root = fileURLToPath(new URL('../', import.meta.url));
 const fixture = resolve(root, 'tests/fixtures/package-consumer');
 const tempDir = mkdtempSync(join(tmpdir(), 'anchor-kit-consumer-'));
 
+// The consumer smoke must use the same pinned Bun version as the build.
+const pinnedBunVersion = process.env.ANCHOR_KIT_BUN_VERSION;
+
 function run(command, args, cwd) {
   const result = spawnSync(command, args, {
     cwd,
@@ -22,7 +25,22 @@ function run(command, args, cwd) {
   return result.stdout;
 }
 
+function assertPinnedBunVersion() {
+  if (!pinnedBunVersion) {
+    throw new Error(
+      'ANCHOR_KIT_BUN_VERSION is not set; the package smoke must use the same pinned Bun version as the build',
+    );
+  }
+  const actual = run('bun', ['--version'], root).trim();
+  if (actual !== pinnedBunVersion) {
+    throw new Error(
+      `Bun version mismatch: expected ${pinnedBunVersion} (ANCHOR_KIT_BUN_VERSION) but found ${actual}`,
+    );
+  }
+}
+
 try {
+  assertPinnedBunVersion();
   run('npm', ['pack', '--pack-destination', tempDir], root);
   const packageArchive = readdirSync(tempDir).find((name) => name.endsWith('.tgz'));
   if (!packageArchive) {

scripts/check-package-smoke.mjs

@@ -9,6 +9,8 @@ const temporaryDirectory = mkdtempSync(join(tmpdir(), 'anchor-kit-package-smoke-
 const consumerDirectory = join(temporaryDirectory, 'consumer');
 mkdirSync(consumerDirectory);
 
+const expectedBunVersion = process.env.ANCHOR_KIT_BUN_VERSION ?? '1.2.0';
+
 function findBunExecutable() {
   const pathEntries = (process.env.PATH ?? '').split(delimiter);
   const executables = pathEntries.flatMap((directory) => [
@@ -41,6 +43,13 @@ function run(command, args, cwd) {
 }
 
 try {
+  const bunVersion = run('bun', ['--version'], repositoryRoot).trim();
+  if (bunVersion !== expectedBunVersion) {
+    throw new Error(
+      `Bun ${expectedBunVersion} is required for the package smoke; found ${bunVersion}`,
+    );
+  }
+
   const npmCommand = 'npm';
   const bunCommand = 'bun';
   const packOutput = run(

tests/publish-workflow.test.ts

@@ -3,6 +3,18 @@ import { describe, expect, it } from 'vitest';
 
 const workflow = readFileSync(new URL('../.github/workflows/publish.yml', import.meta.url), 'utf8');
 
+const supportedBunVersion = '1.1.38';
+const ciWorkflow = readFileSync(new URL('../.github/workflows/ci.yml', import.meta.url), 'utf8');
+
+describe('pinned Bun version', () => {
+  it('uses the same supported Bun version in publish and CI workflows', () => {
+    expect(workflow).toContain(`bun-version: ${supportedBunVersion}`);
+    expect(ciWorkflow).toContain(`bun-version: ${supportedBunVersion}`);
+    expect(workflow).not.toMatch(/bun-version:\s*latest/);
+    expect(ciWorkflow).not.toMatch(/bun-version:\s*latest/);
+  });
+});
+
 describe('npm publish repository guard', () => {
   it('allows published releases in Anchor-kit/anchor-kit and excludes unrelated repositories', () => {
     expect(workflow).toMatch(/^\s+release:\r?\n\s+types:\s+\[published\]\s*$/m);