Pin Bun 1.4.0, compose the asset matrix, share the download cache

.github/workflows/ci.yml

@@ -21,7 +21,7 @@ jobs:
 
       - uses: oven-sh/setup-bun@v2
         with:
-          bun-version: 1.3.14
+          bun-version: 1.4.0
 
       - name: Compile
         run: ./mill --no-server millbun.compile

.github/workflows/release.yml

@@ -31,7 +31,7 @@ jobs:
       - name: Set up Bun
         uses: oven-sh/setup-bun@v2
         with:
-          bun-version: 1.3.14
+          bun-version: 1.4.0
 
       - name: Cache Coursier
         uses: actions/cache@v4

CHANGELOG.md

@@ -11,7 +11,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 - Tag-driven release workflow for Maven Central publishing and GitHub releases.
 - Release runbook covering secrets, version sweep, annotated tags, and verification.
-- Checksum-verified managed Bun 1.3.14 for macOS, Linux, and Windows on x64 and arm64.
+- Checksum-verified managed Bun 1.4.0 for macOS, Linux, and Windows on x64 and arm64, including
+  musl (auto-detected) and `-baseline` (via `bunUseBaseline`) builds.
+- `bunArchiveSha256` may be set on its own to run a Bun version with no bundled checksum; the
+  download URL is derived from `bunVersion` and the detected platform.
 - Strict text-lockfile workflow with `bunLock`, frozen installs, and actionable missing-lock failures.
 - Canonical `bundle`, `bundleFast`, `compileExecutable`, and `compileExecutables` task names.
 - Paired `BunScalaJSWebModule` and `BunTypeScriptWebModule` HTML workflows.

README.md

@@ -9,7 +9,7 @@ It keeps Mill's task graph, caching, module relationships, Scala.js linker, and
 - Mill 1.1.5+
 - JDK 17+
 
-Bun does not need to be installed. The plugin downloads and verifies Bun 1.3.14 by default on supported macOS, Linux, and Windows x64/arm64 hosts. Set `MILL_BUN_USE_SYSTEM=true` to opt into the Bun on `PATH`.
+Bun does not need to be installed. The plugin downloads and checksum-verifies Bun 1.4.0 by default on macOS, Linux, and Windows x64/arm64. musl-based Linux (Alpine) is detected automatically; on x64 CPUs without AVX2, set `bunUseBaseline`. Set `MILL_BUN_USE_SYSTEM=true` to opt into the Bun on `PATH` instead.
 
 ## Scala.js quick start
 
@@ -129,9 +129,18 @@ Resolution order is:
 
 1. `bunExecutableOverride`
 2. system `PATH` when `bunUseSystem` or `MILL_BUN_USE_SYSTEM=true`
-3. checksum-verified managed Bun 1.3.14
+3. checksum-verified managed Bun 1.4.0
 
-Use `./mill app.bunDoctor` to print and validate the resolved executable, version, revision, mode, and linker. Custom mirrors or unbundled Bun versions must configure both `bunArchiveUrl` and `bunArchiveSha256`.
+Use `./mill app.bunDoctor` to print and validate the resolved executable, version, revision, mode, selected release asset, and linker.
+
+To run a Bun version with no bundled checksum, set `bunVersion` and `bunArchiveSha256` — the download URL is derived from the version and the detected platform:
+
+```scala
+def bunVersion = Task { "1.4.1" }
+def bunArchiveSha256 = Task { Some("<sha256 from the release SHASUMS256.txt>") }
+```
+
+Set `bunArchiveUrl` as well to download from a mirror; a mirror always requires `bunArchiveSha256` so the archive stays verified.
 
 ## Mixed Scala.js and TypeScript workspaces
 

build.mill

@@ -37,9 +37,11 @@ object millbun extends ScalaModule, PublishModule {
       Map(
         "MILL_EXECUTABLE_PATH" -> millScript.toString,
         "COURSIER_REPOSITORIES" -> repos.mkString("|"),
-        // Existing fixtures exercise installed Bun behavior. Dedicated tests cover
-        // managed resolution and strict lockfile failures.
-        "MILL_BUN_USE_SYSTEM" -> Task.env.getOrElse("MILL_BUN_USE_SYSTEM", "true"),
+        // Default to the managed toolchain, so the suite exercises the same Bun the plugin
+        // pins rather than whatever the developer happens to have on PATH. The shared
+        // download cache means all fixtures reuse one archive. Export MILL_BUN_USE_SYSTEM=true
+        // to run against a local Bun instead.
+        "MILL_BUN_USE_SYSTEM" -> Task.env.getOrElse("MILL_BUN_USE_SYSTEM", "false"),
         "MILL_BUN_REQUIRE_LOCKFILE" -> Task.env.getOrElse("MILL_BUN_REQUIRE_LOCKFILE", "false")
       )
     }

docs/MIGRATING-0.3.md

@@ -44,7 +44,7 @@ The old names are planned for removal at 1.0.
 
 ## Toolchain behavior
 
-The default is now checksum-verified managed Bun 1.3.14. To preserve the old PATH behavior:
+The default is now checksum-verified managed Bun 1.4.0. To preserve the old PATH behavior:
 
 ```bash
 export MILL_BUN_USE_SYSTEM=true

millbun/integration/resources/typescript-env/build.mill

@@ -13,5 +13,8 @@ object app extends BunTypeScriptModule {
   override def npmDevDeps = Task { Seq("typescript@5.7.3") }
   def bunProxy = Task.Source(moduleDir / "bun-proxy")
   override def managedBunExecutable = Task { Some(PathRef(bunProxy().path)) }
+  // The proxy execs whatever Bun is on PATH, so its --version reports the developer's Bun rather
+  // than bunVersion. This fixture tests env propagation, not the version pin.
+  override def bunVerifyVersion = Task { false }
   override def bunEnv = Task { Map("BUN_PROXY_MARKER" -> "present") }
 }

millbun/integration/src/mill/bun/BunManagedToolchainIntegrationTests.scala

@@ -19,4 +19,4 @@ object BunManagedToolchainIntegrationTests extends TestSuite:
       assert(result.isSuccess)
       val executable = tester.out("app.bunExecutable").value[String]
       val version = os.proc(executable, "--version").call(stdout = os.Pipe).out.text().trim
-      assert(version == "1.3.14")
+      assert(version == "1.4.0")

millbun/integration/src/mill/bun/BunTypeScriptIntegrationTests.scala

@@ -107,7 +107,8 @@ object BunTypeScriptIntegrationTests extends TestSuite {
       val packageJson = ujson.read(os.read(tester.workspacePath / "out" / "app" / "npmInstall.dest" / "package.json"))
       val devDeps = packageJson("devDependencies").obj
 
-      assert(devDeps("@types/bun").str == "1.3.11")
+      // Pinned, and pinned to the Bun we ship: @types/bun is published in lockstep with Bun.
+      assert(devDeps("@types/bun").str == BunToolchainModule.DefaultBunVersion)
       assert(devDeps("@types/bun").str != "latest")
       assert(!devDeps.contains("@types/node"))
     }