v0.7.0

Source commit: be85cc874c380ca9a0421b094ea03ab32118d473

Install the verified source archive using Bzlmod:

bazel_dep(name = "curlewlabs_rules_bun", version = "0.7.0")
archive_override(
    module_name = "curlewlabs_rules_bun",
    urls = ["https://github.com/curlewlabs-com/rules_bun/releases/download/v0.7.0/rules_bun-0.7.0.tar.gz"],
    integrity = "sha256-M3AisZAi/V2qLCVWT2MmwQuwIA+IfMDdikDZctjRs4o=",
    strip_prefix = "rules_bun-0.7.0",
)

The archive includes generated API documentation at docs/api.md, the runnable
independent consumer, and license notices. Runtimes and npm packages are
separate downloads with their own licenses. Acquisition is unsandboxed;
consumers supply their own execution isolation. This release is not a BCR entry.

What's Changed

• Pin the example consumer to the published 0.6.0 archive by @jeffwall-curlewlabs in #31
• Keep the acquiring runtimes' digests out of :files by @jeffwall-curlewlabs in #32
• Prepare the 0.7.0 release by @jeffwall-curlewlabs in #33

Full Changelog: v0.6.0...v0.7.0

v0.6.0

Source commit: 99a156728c1c4b98799e3f3fc951c5b859cc4635

Install the verified source archive using Bzlmod:

bazel_dep(name = "curlewlabs_rules_bun", version = "0.6.0")
archive_override(
    module_name = "curlewlabs_rules_bun",
    urls = ["https://github.com/curlewlabs-com/rules_bun/releases/download/v0.6.0/rules_bun-0.6.0.tar.gz"],
    integrity = "sha256-rPvnZddvfWL+9g+pgRPrh4OE7VrFf5euQ16WLygIsIk=",
    strip_prefix = "rules_bun-0.6.0",
)

The archive includes generated API documentation at docs/api.md, the runnable
independent consumer, and license notices. Runtimes and npm packages are
separate downloads with their own licenses. Acquisition is unsandboxed;
consumers supply their own execution isolation. This release is not a BCR entry.

Changes in 0.6.0

• bun_install gains optional os and cpu attributes (#29), npm platform names such as darwin and arm64. The closure then carries that platform's native optional packages instead of the acquisition host's, for an action that executes on that platform: the planner downloads that platform's locked tarballs, and Bun receives --os and --cpu. Lifecycle scripts still run on the acquisition host, so a package whose script builds or selects a native binary for the host is the consumer's to verify. A value outside lowercase letters and digits fails acquisition. Without either attribute, behavior is unchanged.

What's Changed

• Pin the example consumer to the published 0.5.0 archive by @jeffwall-curlewlabs in #27
• Give the command that verifies a release's provenance by @jeffwall-curlewlabs in #28
• Let a closure carry another platform's native packages by @jeffwall-curlewlabs in #29
• Prepare the 0.6.0 release by @jeffwall-curlewlabs in #30

Full Changelog: v0.5.0...v0.6.0

v0.5.0

Source commit: 1e74cba53312d5b803ab811caa4cf38a0027f694

Install the verified source archive using Bzlmod:

bazel_dep(name = "curlewlabs_rules_bun", version = "0.5.0")
archive_override(
    module_name = "curlewlabs_rules_bun",
    urls = ["https://github.com/curlewlabs-com/rules_bun/releases/download/v0.5.0/rules_bun-0.5.0.tar.gz"],
    integrity = "sha256-VcykCpTUbSMzXDVoO/VQaWRwXTjv8XWOdZJenJZa3r0=",
    strip_prefix = "rules_bun-0.5.0",
)

The archive includes generated API documentation at docs/api.md, the runnable
independent consumer, and license notices. Runtimes and npm packages are
separate downloads with their own licenses. Acquisition is unsandboxed;
consumers supply their own execution isolation. This release is not a BCR entry.

Changes in 0.5.0

• bun_install gains optional bun_identity and node_identity attributes (#25). Each names a small file whose content changes whenever that runtime's bytes do, such as the pin the binary was downloaded from. The rule then watches that file instead of the binary, so checking a cached acquisition no longer hashes the runtime binaries. A binary replaced in place under an unchanged identity keeps the acquisition made with the old one. A declared identity file that does not exist fails acquisition. Without either attribute, behavior is unchanged.

What's Changed

• Pin the example consumer to the published 0.4.0 archive by @jeffwall-curlewlabs in #19
• Say when a consumer needs to validate regular-file digests by @jeffwall-curlewlabs in #22
• Stop tracking a stale Python bytecode file by @jeffwall-curlewlabs in #24
• Let a small identity file key each runtime instead of its binary by @jeffwall-curlewlabs in #25
• Prepare the 0.5.0 release by @jeffwall-curlewlabs in #26

Full Changelog: v0.4.0...v0.5.0

v0.4.0

Source commit: f7d3b831a7d8761f79a4f3ebef29f9d0f9ac9565

Install the verified source archive using Bzlmod:

bazel_dep(name = "curlewlabs_rules_bun", version = "0.4.0")
archive_override(
    module_name = "curlewlabs_rules_bun",
    urls = ["https://github.com/curlewlabs-com/rules_bun/releases/download/v0.4.0/rules_bun-0.4.0.tar.gz"],
    integrity = "sha256-fMoHvehRItTv6rqZ9DZyCvHUlmPh7JI2j9FrKOYZ0UE=",
    strip_prefix = "rules_bun-0.4.0",
)

The archive includes generated API documentation at docs/api.md, the runnable
independent consumer, and license notices. Runtimes and npm packages are
separate downloads with their own licenses. Acquisition is unsandboxed;
consumers supply their own execution isolation. This release is not a BCR entry.

Changes in 0.4.0

• The same inputs now record the same closure (#16, #17). Bun's isolated linker left two parts of the layout to install timing: an alias's fallback link racing the package's own, and a bin inside a dependency cycle. Acquisition now settles both, so reproducible = True holds for closures with aliased or cyclic packages.
• Tightening: a root .npmrc that sets hoist-pattern, or a root bunfig.toml that sets hoistPattern, now fails acquisition. Remove the setting; the rule sets Bun's hoist pattern itself.
• closure.json gains a layout digest. The field is additive; the format identifier stays 1.

What's Changed

• Pin the example consumer to the published 0.3.0 archive by @jeffwall-curlewlabs in #15
• Make Bun's isolated layout a function of the lock by @jeffwall-curlewlabs in #17
• Prepare the 0.4.0 release by @jeffwall-curlewlabs in #18

Full Changelog: v0.3.0...v0.4.0

v0.3.0

Source commit: c2281137b9b751b28754022807564d3ae38ea155

Install the verified source archive using Bzlmod:

bazel_dep(name = "curlewlabs_rules_bun", version = "0.3.0")
archive_override(
    module_name = "curlewlabs_rules_bun",
    urls = ["https://github.com/curlewlabs-com/rules_bun/releases/download/v0.3.0/rules_bun-0.3.0.tar.gz"],
    integrity = "sha256-45Fg01OdZviNINSbkcTYNA35TbpGrwCx5WMTAwarStc=",
    strip_prefix = "rules_bun-0.3.0",
)

The archive includes generated API documentation at docs/api.md, the runnable
independent consumer, and license notices. Runtimes and npm packages are
separate downloads with their own licenses. Acquisition is unsandboxed;
consumers supply their own execution isolation. This release is not a BCR entry.

What's Changed

• Pin the example consumer to the published 0.2.0 archive by @jeffwall-curlewlabs in #12
• Let an acquisition declare itself reproducible by @jeffwall-curlewlabs in #13
• Prepare the 0.3.0 release by @jeffwall-curlewlabs in #14

Full Changelog: v0.2.0...v0.3.0

v0.2.0

Source commit: d34c2ba616e08a6bb9a33d1851af7d1e417f50e0

Install the verified source archive using Bzlmod:

bazel_dep(name = "curlewlabs_rules_bun", version = "0.2.0")
archive_override(
    module_name = "curlewlabs_rules_bun",
    urls = ["https://github.com/curlewlabs-com/rules_bun/releases/download/v0.2.0/rules_bun-0.2.0.tar.gz"],
    integrity = "sha256-2sAQsWO5JdHz1YxaLY90kkHX8hnzPEh8krm5aaAIXqY=",
    strip_prefix = "rules_bun-0.2.0",
)

The archive includes generated API documentation at docs/api.md, the runnable
independent consumer, and license notices. Runtimes and npm packages are
separate downloads with their own licenses. Acquisition is unsandboxed;
consumers supply their own execution isolation. This release is not a BCR entry.

What's Changed

• Exercise the published release through the independent consumer by @jeffwall-curlewlabs in #9
• Install from Bazel-downloaded, integrity-verified tarballs by @jeffwall-curlewlabs in #10
• Prepare the 0.2.0 release by @jeffwall-curlewlabs in #11

Full Changelog: v0.1.0...v0.2.0

Tightening and migration from 0.1.x

• Only default-registry packages are acquired. Lock entries from tarball URLs, Git, other registries, or without an integrity value now fail planning with Unsupported lock entry. Depend on those packages through the default npm registry, or stay on 0.1.x.
• Registry settings in declared inputs no longer redirect downloads. Bazel fetches every locked tarball from https://registry.npmjs.org/ against its lock integrity, and Bun installs from a loopback registry. Do not put tokens or passwords in declared inputs.
• Tarballs are cached by Bazel's repository cache: fetched once per host and checked against their lock integrity on every reuse. closure.json gains an additive planner digest; the format identifier is unchanged.

v0.1.0

Source commit: 65ee6d8781621a986d7c4cba89c8116506a3e9ff

Install the verified source archive using Bzlmod:

bazel_dep(name = "curlewlabs_rules_bun", version = "0.1.0")
archive_override(
    module_name = "curlewlabs_rules_bun",
    urls = ["https://github.com/curlewlabs-com/rules_bun/releases/download/v0.1.0/rules_bun-0.1.0.tar.gz"],
    integrity = "sha256-n5ShxTw4UOsJXiRcBz1WjhBh/rQOYFHqShv+CTGZC7Q=",
    strip_prefix = "rules_bun-0.1.0",
)

The archive includes generated API documentation at docs/api.md, the runnable
independent consumer, and license notices. Runtimes and npm packages are
separate downloads with their own licenses. Acquisition is unsandboxed;
consumers supply their own execution isolation. This release is not a BCR entry.

What's Changed

• Explain how workspace acquisition differs from Tomato rules_bun by @jeffwall-curlewlabs in #2
• Declare the 0.1.0 toolchain and recognize Linux amd64 by @jeffwall-curlewlabs in #3
• Add native integration CI and an independent archive consumer by @jeffwall-curlewlabs in #5
• Verify incremental and concurrent Bun acquisition by @jeffwall-curlewlabs in #6
• Define API compatibility and security policy by @jeffwall-curlewlabs in #7
• Prepare verified source archives and draft releases by @jeffwall-curlewlabs in #8

New Contributors

• @jeffwall-curlewlabs made their first contribution in #2

Full Changelog: https://github.com/curlewlabs-com/rules_bun/commits/v0.1.0