refactor: replace bun with pnpm#870
Merged
Merged
Conversation
dosubot
Bot
added
the
size:M
Contributor
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
✅ Files skipped from review due to trivial changes (1)
📝 WalkthroughWalkthroughProject-wide migration from Bun to pnpm: package metadata now declares pnpm, dependabot switches ecosystem, CI workflows and release/nightly jobs add pnpm setup and use pnpm commands, Dockerfiles and Makefile targets switch to pnpm, and contributor docs/dev Dockerfiles updated accordingly. ChangesMigrate frontend build toolchain from Bun to pnpm
🎯 3 (Moderate) | ⏱️ ~20 minutes
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Tip 💬 Introducing Slack Agent: The best way for teams to turn conversations into code.Slack Agent is built on CodeRabbit's deep understanding of your code, so your team can collaborate across the entire SDLC without losing context.
Built for teams:
One agent for your entire SDLC. Right inside Slack. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@frontend/package.json`:
- Line 13: Update the packageManager entry in package.json to the correct stable
pnpm version: replace the current "packageManager" value "pnpm@11.1.2" with
"pnpm@11.0.6" so Corepack can resolve the tool; ensure the "packageManager"
field is updated (packageManager) and commit the change so CI will pick up the
valid pnpm version.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 0b5d917e-6dc1-4962-9cc1-63275eed2442
⛔ Files ignored due to path filters (2)
frontend/bun.lockis excluded by!**/*.lockfrontend/pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (13)
.github/dependabot.yml.github/workflows/ci.yml.github/workflows/nightly.yml.github/workflows/release.ymlCONTRIBUTING.mdDockerfileDockerfile.devDockerfile.distrolessMakefilefrontend/.prettierignorefrontend/.prettierrcfrontend/Dockerfile.devfrontend/package.json
💤 Files with no reviewable changes (2)
- frontend/.prettierrc
- frontend/.prettierignore
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (2)
.github/workflows/ci.yml (2)
18-21: ⚡ Quick winAdd explicit Node.js setup for version control.
While
ubuntu-latestrunners include Node.js by default, explicitly setting up Node.js ensures a consistent, reproducible environment and prevents potential issues if the runner's default version changes.📦 Suggested addition of setup-node step
- name: Checkout code uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - name: Setup Node.js + uses: actions/setup-node@42a0a3d7c0ee6a09c7adafc7d8f1d4da3f6b1cb4 # v6 + with: + node-version: '26' + - name: Setup pnpm uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8 with: package_json_file: ./frontend/package.json🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/ci.yml around lines 18 - 21, Add an explicit Node.js setup step before the "Setup pnpm" step to pin the Node version used by the runner: insert an actions/setup-node@v3 step (e.g., with node-version: 18 or your supported version) so the workflow deterministically installs the Node runtime before the pnpm/action-setup step that references package_json_file (./frontend/package.json); ensure the new step appears above the "Setup pnpm" step in the job and uses the chosen node-version input.
18-47: ⚡ Quick winConsider adding dependency caching for faster CI runs.
Adding caching for pnpm dependencies would significantly improve CI performance by avoiding re-downloading packages on every run.
⚡ Suggested pnpm caching configuration
Some versions of
pnpm/action-setupinclude built-in caching. Check if your version supports it, or add explicit caching:Option 1: Using setup-node with pnpm cache (if you add setup-node step)
- name: Setup Node.js uses: actions/setup-node@42a0a3d7c0ee6a09c7adafc7d8f1d4da3f6b1cb4 # v6 with: node-version: '26' + cache: 'pnpm' + cache-dependency-path: './frontend/pnpm-lock.yaml'Option 2: Explicit cache action
- name: Setup pnpm uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8 with: package_json_file: ./frontend/package.json + - name: Cache pnpm store + uses: actions/cache@v4 + with: + path: ~/.local/share/pnpm/store + key: ${{ runner.os }}-pnpm-store-${{ hashFiles('frontend/pnpm-lock.yaml') }} + restore-keys: | + ${{ runner.os }}-pnpm-store-🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/ci.yml around lines 18 - 47, Add caching steps to the workflow to speed up CI: add an actions/cache step keyed on frontend/node_modules/.pnpm-store (or pnpm store path used by pnpm/action-setup) and the package-lock/sha of frontend/package.json around the "Setup pnpm" / "Install frontend dependencies" steps to restore/save the pnpm store, and add a separate actions/cache for Go modules (GOMODCACHE or ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}) around the "Go dependencies" step; reference the existing step names ("Setup pnpm", "Install frontend dependencies", "Go dependencies") and the action pnpm/action-setup to locate where to insert the cache restore+save steps.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/ci.yml:
- Around line 18-21: The "Setup pnpm" GitHub Action currently uses
pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 with the
package_json_file input which is affected by a v6 bug; update the action usage
in the pnpm setup step (the step named "Setup pnpm" that uses pnpm/action-setup)
to explicitly set the pnpm version via the with: version input (e.g., version:
11.1.1) or alternatively bump the action to pnpm/action-setup v7+ so the
package_json_file workaround is not needed.
---
Nitpick comments:
In @.github/workflows/ci.yml:
- Around line 18-21: Add an explicit Node.js setup step before the "Setup pnpm"
step to pin the Node version used by the runner: insert an actions/setup-node@v3
step (e.g., with node-version: 18 or your supported version) so the workflow
deterministically installs the Node runtime before the pnpm/action-setup step
that references package_json_file (./frontend/package.json); ensure the new step
appears above the "Setup pnpm" step in the job and uses the chosen node-version
input.
- Around line 18-47: Add caching steps to the workflow to speed up CI: add an
actions/cache step keyed on frontend/node_modules/.pnpm-store (or pnpm store
path used by pnpm/action-setup) and the package-lock/sha of
frontend/package.json around the "Setup pnpm" / "Install frontend dependencies"
steps to restore/save the pnpm store, and add a separate actions/cache for Go
modules (GOMODCACHE or ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}) around
the "Go dependencies" step; reference the existing step names ("Setup pnpm",
"Install frontend dependencies", "Go dependencies") and the action
pnpm/action-setup to locate where to insert the cache restore+save steps.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 74b0c56d-ce63-4387-b789-5703c61ec9a0
📒 Files selected for processing (3)
.github/workflows/ci.yml.github/workflows/nightly.yml.github/workflows/release.yml
🚧 Files skipped from review as they are similar to previous changes (2)
- .github/workflows/release.yml
- .github/workflows/nightly.yml
Rycochet
approved these changes
May 15, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Don't get me wrong, I
amwas a huge fan of Bun. A fast package-manager, bundler, runtime that does everything and works. Never had issues with it.However, the recent rewrite oven-sh/bun#30412 in Rust makes me no longer trust Bun as whole. Not because I don't like Rust, I like Rust, not a huge fan of it, but definitely better than writing C++. The issue lies in the nature of this rewrite. The whole thing was completely generated by an LLM and merged within 1 week. I cannot trust an algorithm that tells you it's better to walk to the car wash to wash your car to rewrite over a million lines of code and I also don't believe that the Bun team itself knows how to navigate and work in the new Rust codebase. Even if the change passes tests and works, I still don't trust it will work in the future and that it's not a mess of tech debt waiting to implode. These changes should happen throughout the duration of months not weeks.
This is why this pull request completely removes all use of Bun and instead replaces it with pnpm. Tinyauth only needs a package manager, not a runtime since the frontend compiles to static files and thus, pnpm is a perfect fit. It's a fast and intelligent package manager that solves npm's headaches (massive node modules, conflicts, speed). This change shouldn't have a big impact on development, just install pnpm with
npm install -g pnpmand you should be good to go (pnpm has aliases for all regular npm commands).It's been a fun ride, Bun.
Summary by CodeRabbit