ci(bun): fix rebased migration regressions

## Summary

- keep sparse CI and OCI installs complete
- restore fail-closed Bun lock traversal and exact attribution refresh
- remove redundant fallback branches exposed by current lint

## Why

Sparse jobs invoke the Node setup action, which reads package.json to select the pinned Bun version. The OCI build also needs trusted dependency lifecycle scripts while skipping only the package prepare hook.

The extracted lock reader had lost the previous parser validation and ancestor/workspace resolution, allowing malformed or incomplete locks to silently shrink license attribution. Single-version rows also retained stale registry metadata.

## Test plan

- npm run test:scripts
- npm run lint
- node scripts/generate-3rdparty-licenses.js --check
- changed-line c8 coverage for the affected scripts

Author: BridgeAR

.github/workflows/all-green.yml

@@ -24,6 +24,7 @@ jobs:
           sparse-checkout: |
             .github
             bunfig.toml
+            package.json
             scripts
       - uses: ./.github/actions/node
         with:

.github/workflows/project.yml

@@ -15,7 +15,9 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
-          sparse-checkout: .github
+          sparse-checkout: |
+            .github
+            package.json
       - uses: ./.github/actions/node/latest
       - name: actionlint
         id: actionlint
@@ -82,6 +84,7 @@ jobs:
         with:
           sparse-checkout: |
             .github
+            package.json
             scripts/verify-workflow-job-names.js
       - uses: ./.github/actions/node/latest
       - run: npm install yaml

.gitlab/prepare-oci-package.sh

@@ -12,8 +12,9 @@ bun=$(node -e "process.stdout.write(require('./scripts/bun').getBunBinary())")
 mkdir -p packaging/sources
 
 tar -xOf "$archive" package/package.json > packaging/sources/package.json
+npm pkg delete scripts.prepare --prefix packaging/sources
 cp bun.lock packaging/sources/bun.lock
-"$bun" --config="$PWD/bunfig.toml" install --production --frozen-lockfile --ignore-scripts \
+"$bun" --config="$PWD/bunfig.toml" install --production --frozen-lockfile \
   --linker=hoisted --network-concurrency 8 --cwd packaging/sources
 
 rm packaging/sources/package.json packaging/sources/bun.lock

LICENSE-3rdparty.csv

@@ -1,13 +1,13 @@
 "component","origin","license","copyright"
-"@apm-js-collab/code-transformer","https://github.com/nodejs/orchestrion-js","['Apache-2.0']","['nodejs']"
-"@datadog/flagging-core","https://github.com/DataDog/openfeature-js-client","['Apache-2.0']","['DataDog']"
+"@apm-js-collab/code-transformer","https://github.com/nodejs/orchestrion-js","['Apache-2.0']","[]"
+"@datadog/flagging-core","https://github.com/DataDog/openfeature-js-client","['Apache-2.0']","[]"
 "@datadog/libdatadog","https://github.com/DataDog/libdatadog-nodejs","['Apache-2.0']","['Datadog Inc.']"
 "@datadog/native-appsec","https://github.com/DataDog/dd-native-appsec-js","['Apache-2.0']","['Datadog Inc.']"
 "@datadog/native-iast-taint-tracking","https://github.com/DataDog/dd-native-iast-taint-tracking-js","['Apache-2.0']","['Datadog Inc.']"
 "@datadog/native-metrics","https://github.com/DataDog/dd-native-metrics-js","['Apache-2.0']","['Datadog Inc.']"
-"@datadog/openfeature-node-server","https://github.com/DataDog/openfeature-js-client","['Apache-2.0']","['DataDog']"
+"@datadog/openfeature-node-server","https://github.com/DataDog/openfeature-js-client","['Apache-2.0']","[]"
 "@datadog/pprof","https://github.com/DataDog/pprof-nodejs","['Apache-2.0']","['Google Inc.']"
-"@datadog/sketches-js","https://github.com/DataDog/sketches-js","['Apache-2.0']","['DataDog']"
+"@datadog/sketches-js","https://github.com/DataDog/sketches-js","['Apache-2.0']","[]"
 "@datadog/wasm-js-rewriter","https://github.com/DataDog/dd-wasm-js-rewriter","['Apache-2.0']","['Datadog Inc.']"
 "@emnapi/core","https://github.com/toyobayashi/emnapi","['MIT']","['toyobayashi']"
 "@emnapi/runtime","https://github.com/toyobayashi/emnapi","['MIT']","['toyobayashi']"
@@ -45,8 +45,8 @@
 "@oxc-parser/binding-win32-x64-msvc","https://github.com/oxc-project/oxc","['MIT']","['Boshen and oxc contributors']"
 "@oxc-project/types","https://github.com/oxc-project/oxc","['MIT']","['Boshen and oxc contributors']"
 "@tybys/wasm-util","https://github.com/toyobayashi/wasm-util","['MIT']","['toyobayashi']"
-"@types/estree","https://github.com/DefinitelyTyped/DefinitelyTyped","['MIT']","['DefinitelyTyped']"
-"argparse","https://github.com/nodeca/argparse","['Python-2.0']","['nodeca']"
+"@types/estree","https://github.com/DefinitelyTyped/DefinitelyTyped","['MIT']","['RReverser']"
+"argparse","https://github.com/nodeca/argparse","['Python-2.0']","[]"
 "astring","https://github.com/davidbonnet/astring","['MIT']","['David Bonnet']"
 "cjs-module-lexer","https://github.com/nodejs/cjs-module-lexer","['MIT']","['Guy Bedford']"
 "crypto-randomuuid","npm:crypto-randomuuid","['MIT']","['Stephen Belanger']"
@@ -56,24 +56,24 @@
 "es-module-lexer","https://github.com/guybedford/es-module-lexer","['MIT']","['Guy Bedford']"
 "escape-string-regexp","https://github.com/sindresorhus/escape-string-regexp","['MIT']","['Sindre Sorhus']"
 "esquery","https://github.com/estools/esquery","['BSD-3-Clause']","['Joel Feenstra']"
-"estraverse","https://github.com/estools/estraverse","['BSD-2-Clause']","['estools']"
+"estraverse","https://github.com/estools/estraverse","['BSD-2-Clause']","[]"
 "fast-fifo","https://github.com/mafintosh/fast-fifo","['MIT']","['Mathias Buus']"
 "import-in-the-middle","https://github.com/nodejs/import-in-the-middle","['Apache-2.0']","['Bryan English']"
 "istanbul-lib-coverage","https://github.com/istanbuljs/istanbuljs","['BSD-3-Clause']","['Krishnan Anantheswaran']"
-"jest-docblock","https://github.com/jestjs/jest","['MIT']","['jestjs']"
-"js-yaml","https://github.com/nodeca/js-yaml","['MIT']","['Vladimir Zapparov']"
+"jest-docblock","https://github.com/jestjs/jest","['MIT']","[]"
+"js-yaml","https://github.com/nodeca/js-yaml","['MIT']","['Vladimir Zapparov', 'Aleksey V Zapparov', 'Vitaly Puzrin', 'Martin Grenfell']"
 "jsep","https://github.com/EricSmekens/jsep","['MIT']","['Stephen Oney']"
-"jsonpath-plus","https://github.com/JSONPath-Plus/JSONPath","['MIT']","['Stefan Goessner']"
+"jsonpath-plus","https://github.com/s3u/JSONPath","['MIT']","['Stefan Goessner', 'Prof. Gössner', 'Subbu Allamaraju', 'Mike Brevoort', 'Robert Krahn', 'Brett Zamir', 'Richard Schneider']"
 "limiter","https://github.com/jhurliman/node-rate-limiter","['MIT']","['John Hurliman']"
-"lodash.sortby","https://github.com/lodash/lodash","['MIT']","['John-David Dalton']"
+"lodash.sortby","https://github.com/lodash/lodash","['MIT']","['John-David Dalton', 'Blaine Bublitz', 'Mathias Bynens']"
 "long","https://github.com/dcodeIO/long.js","['Apache-2.0']","['Daniel Wirtz']"
 "lru-cache","https://github.com/isaacs/node-lru-cache","['ISC']","['Isaac Z. Schlueter']"
-"meriyah","https://github.com/meriyah/meriyah","['ISC']","['Kenny F.']"
+"meriyah","https://github.com/meriyah/meriyah","['ISC']","['Kenny F.', 'Chunpeng Huo']"
 "module-details-from-path","https://github.com/watson/module-details-from-path","['MIT']","['Thomas Watson']"
 "mutexify","https://github.com/mafintosh/mutexify","['MIT']","['Mathias Buus']"
-"node-addon-api","https://github.com/nodejs/node-addon-api","['MIT']","['nodejs']"
+"node-addon-api","https://github.com/nodejs/node-addon-api","['MIT']","['Abhishek Kumar Singh', 'Alba Mendez', 'Alexander Floh', 'Ammar Faizi', 'András Timár, Dr', 'Andrew Petersen', 'Anisha Rohra', 'Anna Henningsen', 'Arnaud Botella', 'Arunesh Chandra', 'Azlan Mukhtar', 'Ben Berman', 'Benjamin Byholm', 'Bill Gallafent', 'blagoev', 'Bruce A. MacNaughton', 'Cory Mickelson', 'Daniel Bevenius', 'Dante Calderón', 'Darshan Sen', 'David Halls', 'Deepak Rajamohan', 'Dmitry Ashkadov', 'Dongjin Na', 'Doni Rubiagatra', 'Eric Bickle', 'extremeheat', 'Feng Yu', 'Ferdinand Holzer', 'Gabriel Schulhof', 'Guenter Sandner', 'Gus Caplan', 'Helio Frota', 'Hitesh Kanwathirtha', 'ikokostya', 'Jack Xia', 'Jake Barnes', 'Jake Yoon', 'Jason Ginchereau', 'Jenny', 'Jeroen Janssen', 'Jim Schlight', 'Jinho Bang', 'José Expósito', 'joshgarde', 'Julian Mesa', 'Kasumi Hanazuki', 'Kelvin', 'Kevin Eady', 'Kévin VOYER', 'kidneysolo', 'Koki Nishihara', 'Konstantin Tarkus', 'Kyle Farnung', 'Kyle Kovacs', 'legendecas', 'LongYinan', 'Lovell Fuller', 'Luciano Martorella', 'mastergberry', 'Mathias Küsel', 'Mathias Stearn', 'Matteo Collina', 'Michael Dawson', 'Michael Price', 'Michele Campus', 'Mikhail Cheshkov', 'nempoBu4', 'Nicola Del Gobbo', 'Nick Soggin', 'Nikolai Vavilov', 'Nurbol Alpysbayev', 'pacop', 'Peter Šándor', 'Philipp Renoth', 'rgerd', 'Richard Lau', 'Rolf Timmermans', 'Ross Weir', 'Ryuichi Okumura', 'Saint Gabriel', 'Sampson Gao', 'Sam Roberts', 'strager', 'Taylor Woll', 'Thomas Gentilhomme', 'Tim Rach', 'Tobias Nießen', 'todoroff', 'Toyo Li', 'Tux3', 'Vlad Velmisov', 'Vladimir Morozov', 'WenheLI', 'Xuguang Mei', 'Yohei Kishimoto', 'Yulong Wang', 'Ziqiu Zhao']"
 "node-gyp-build","https://github.com/prebuild/node-gyp-build","['MIT']","['Mathias Buus']"
-"opentracing","https://github.com/opentracing/opentracing-javascript","['Apache-2.0']","['opentracing']"
+"opentracing","https://github.com/opentracing/opentracing-javascript","['Apache-2.0']","[]"
 "oxc-parser","https://github.com/oxc-project/oxc","['MIT']","['Boshen and oxc contributors']"
 "pprof-format","https://github.com/DataDog/pprof-format","['MIT']","['Datadog Inc.']"
 "protobufjs","https://github.com/protobufjs/protobuf.js","['BSD-3-Clause']","['Daniel Wirtz']"
@@ -85,7 +85,7 @@
 "source-map","https://github.com/mozilla/source-map","['BSD-3-Clause']","['Nick Fitzgerald', 'Tobias Koppers', 'Duncan Beevers', 'Stephen Crane', 'Ryan Seddon', 'Miles Elam', 'Mihai Bazon', 'Michael Ficarra', 'Todd Wolfson', 'Alexander Solovyov', 'Felix Gnass', 'Conrad Irwin', 'usrbincc', 'David Glasser', 'Chase Douglas', 'Evan Wallace', 'Heather Arthur', 'Hugh Kennedy', 'Simon Lydell', 'Jmeas Smith', 'Michael Z Goddard', 'azu', 'John Gozde', 'Adam Kirkton', 'Chris Montgomery', 'J. Ryan Stinnett', 'Jack Herrington', 'Chris Truter', 'Daniel Espeset', 'Jamie Wong', 'Eddy Bruël', 'Hawken Rives', 'Gilad Peleg', 'djchie', 'Gary Ye', 'Nicolas Lalevée']"
 "spark-md5","https://github.com/satazor/js-spark-md5","['(WTFPL OR MIT)']","['André Cruz']"
 "tlhunter-sorted-set","https://github.com/tlhunter/node-sorted-set","['MIT']","['Thomas Hunter II']"
-"tslib","https://github.com/microsoft/tslib","['0BSD']","['Microsoft Corp.']"
+"tslib","https://github.com/Microsoft/tslib","['0BSD']","['Microsoft Corp.']"
 "ttl-set","https://github.com/watson/ttl-set","['MIT']","['Thomas Watson']"
 "aws-lambda-nodejs-runtime-interface-client","https://github.com/aws/aws-lambda-nodejs-runtime-interface-client/blob/v2.1.0/src/utils/UserFunction.ts","['Apache-2.0']","['Amazon.com Inc. or its affiliates']"
 "is-git-url","https://github.com/jonschlinkert/is-git-url/blob/396965ffabf2f46656c8af4c47bef1d69f09292e/index.js#L9C15-L9C87","['MIT']","['Jon Schlinkert']"

scripts/generate-3rdparty-licenses.js

@@ -54,11 +54,7 @@ const FETCH_CONCURRENCY = 16
  */
 
 /**
- * @typedef {{
- *   name: string,
- *   versions?: Set<string>,
- *   isRoot?: boolean
- * }} WantedComponent
+ * @typedef {{ name: string, isRoot: true } | { name: string, versions: Set<string>, isRoot?: false }} WantedComponent
  */
 
 run().catch(error => {
@@ -196,8 +192,7 @@ async function fillMetadata (wanted, previous) {
       out.push({ component: entry.name, ...rootSelfMetadata() })
       continue
     }
-    for (const version of entry.versions ?? []) {
-      if (!version) throw new Error(`Cannot fetch exact npm metadata for ${entry.name} without a locked version`)
+    for (const version of entry.versions) {
       toFetch.push({ name: entry.name, version })
     }
   }
@@ -226,12 +221,12 @@ async function fillMetadata (wanted, previous) {
       for (const license of packageLicenses) licenses.add(license)
       for (const owner of packageCopyright) copyright.add(owner)
     }
-    const prev = previous.get(name)
+    const previousOrigin = metadata.length > 1 ? previous.get(name)?.origin : undefined
     out.push({
       component: name,
-      origin: prev?.origin ?? metadata[0].origin,
+      origin: previousOrigin ?? metadata[0].origin,
       license: pythonList([...licenses]),
-      copyright: prev && metadata.length === 1 ? prev.copyright : pythonList([...copyright]),
+      copyright: pythonList([...copyright]),
     })
   }
 
@@ -288,7 +283,9 @@ async function fetchPackageMetadata ({ name, version }) {
 function extractLicenses (data) {
   const licenses = []
   addLicense(data.license, licenses)
-  for (const license of data.licenses ?? []) addLicense(license, licenses)
+  if (data.licenses) {
+    for (const license of data.licenses) addLicense(license, licenses)
+  }
   return [...new Set(licenses)]
 }
 
@@ -346,7 +343,8 @@ function extractCopyright (data) {
   const out = []
   const author = extractName(data.author)
   if (author) out.push(author)
-  for (const contributor of data.contributors ?? []) {
+  if (!data.contributors) return out
+  for (const contributor of data.contributors) {
     const name = extractName(contributor)
     if (name) out.push(name)
   }

scripts/install_plugin_modules.js

@@ -99,10 +99,7 @@ function invalidateCacheOnNodeAbiChange () {
   const versionsDir = join(__dirname, '..', 'versions')
   const nodeAbiFile = join(versionsDir, '.node-abi')
   const currentAbi = process.versions.modules
-  let recordedAbi = ''
-  try {
-    recordedAbi = readFileSync(nodeAbiFile, 'utf8').trim()
-  } catch {}
+  const recordedAbi = existsSync(nodeAbiFile) ? readFileSync(nodeAbiFile, 'utf8').trim() : ''
   if (recordedAbi && recordedAbi !== currentAbi && existsSync(join(versionsDir, 'node_modules'))) {
     rmSync(join(versionsDir, 'node_modules'), { recursive: true, force: true })
     rmSync(join(versionsDir, 'bun.lock'), { force: true })
@@ -148,7 +145,8 @@ function buildInstallStages (packages) {
 
     for (let index = 0; index < rangeStages.length; index++) {
       const stagedRanges = rangeStages[index].get(entry.name)
-      for (const stagedRange of stagedRanges ?? []) {
+      if (!stagedRanges) continue
+      for (const stagedRange of stagedRanges) {
         if (semver.intersects(range, stagedRange)) {
           stageIndex = index + 1
           break
@@ -203,12 +201,19 @@ function applyExternalConfiguration (moduleNames, packages) {
   for (const { name } of packages) activeNames.add(name)
 
   for (const name of activeNames) {
-    for (const external of externals[name] ?? []) {
+    const configurations = externals[name]
+    if (!configurations) continue
+
+    for (const external of configurations) {
       if (external.dep) trustedDependencies.add(external.name)
-      for (const trustedDependency of external.trustedDependencies ?? []) {
-        trustedDependencies.add(trustedDependency)
+      if (external.trustedDependencies) {
+        for (const trustedDependency of external.trustedDependencies) {
+          trustedDependencies.add(trustedDependency)
+        }
       }
-      for (const [dependency, version] of Object.entries(external.overrides ?? {})) {
+      if (!external.overrides) continue
+
+      for (const [dependency, version] of Object.entries(external.overrides)) {
         // Bun only honours a bare package name. A Yarn-style selective path (`parent@1.0.0/child`) or an
         // npm-style nested object is accepted into the manifest and then silently ignored, so the range
         // reads as enforced while resolution stays untouched.

scripts/test/generate-3rdparty-licenses.spec.js

@@ -36,6 +36,7 @@ describe('scripts/generate-3rdparty-licenses.js', () => {
       },
     }))
     fs.writeFileSync(path.join(fixtureDirectory, 'bun.lock'), `{
+      "lockfileVersion": 1,
       "workspaces": {
         "": {
           "dependencies": {
@@ -54,6 +55,7 @@ describe('scripts/generate-3rdparty-licenses.js', () => {
     }`)
     fs.writeFileSync(path.join(fixtureDirectory, 'vendor', 'package.json'), '{}')
     fs.writeFileSync(path.join(fixtureDirectory, 'vendor', 'bun.lock'), JSON.stringify({
+      lockfileVersion: 1,
       workspaces: {
         '': {
           dependencies: {},
@@ -136,6 +138,30 @@ describe('scripts/generate-3rdparty-licenses.js', () => {
     )
   })
 
+  it('refreshes attribution metadata for a single locked version', async () => {
+    fs.writeFileSync(path.join(fixtureDirectory, 'bun.lock'), JSON.stringify({
+      lockfileVersion: 1,
+      workspaces: { '': { dependencies: { foo: '2.0.0' } } },
+      packages: { foo: ['foo@2.0.0', '', {}] },
+    }))
+
+    await runGenerator({
+      DD_TEST_LICENSE_METADATA: JSON.stringify({
+        '2.0.0': {
+          license: 'Apache-2.0',
+          repository: 'https://new.example/repository',
+          author: 'New author',
+        },
+      }),
+    })
+
+    const generated = fs.readFileSync(path.join(fixtureDirectory, 'LICENSE-3rdparty.csv'), 'utf8')
+    assert.match(
+      generated,
+      /"foo","https:\/\/new\.example\/repository","\['Apache-2\.0'\]","\['New author'\]"/
+    )
+  })
+
   it('fails when a copied-source attribution names an installed dependency', async () => {
     fs.writeFileSync(
       path.join(fixtureDirectory, '.github', 'vendored-dependencies.csv'),
@@ -164,28 +190,9 @@ describe('scripts/generate-3rdparty-licenses.js', () => {
     assert.strictEqual(fs.readFileSync(csvPath, 'utf8'), before)
   })
 
-  it('fails when a lock entry has no exact registry version', async () => {
-    fs.writeFileSync(path.join(fixtureDirectory, 'bun.lock'), `{
-      "workspaces": {
-        "": {
-          "dependencies": {
-            "foo": "file:../foo"
-          }
-        }
-      },
-      "packages": {
-        "foo": ["foo", "", {}],
-      },
-    }`)
-
-    await assert.rejects(
-      runGenerator({}),
-      matchesMissingLockedVersion
-    )
-  })
-
   /**
-   * @param {NodeJS.ProcessEnv} env
+   * @param {Record<string, string | undefined>} env
+   * @returns {ReturnType<typeof execFileAsync>}
    */
   function runGenerator (env) {
     const preloadPath = path.join(fixtureDirectory, 'registry-preload.js')
@@ -194,6 +201,7 @@ describe('scripts/generate-3rdparty-licenses.js', () => {
       env: {
         ...process.env,
         ...env,
+        NODE_PATH: [path.join(repoRoot, 'node_modules'), process.env.NODE_PATH].filter(Boolean).join(path.delimiter),
         NODE_OPTIONS: `${process.env.NODE_OPTIONS ?? ''} --require=${preloadPath}`.trim(),
       },
     })
@@ -216,14 +224,6 @@ function matchesDuplicateAttribution (error) {
   return true
 }
 
-/**
- * @param {Error & { stderr: string }} error
- */
-function matchesMissingLockedVersion (error) {
-  assert.match(error.stderr, /Cannot fetch exact npm metadata for foo without a locked version/)
-  return true
-}
-
 const registryPreload = String.raw`
 'use strict'
 

scripts/test/install-plugin-modules.spec.js

@@ -298,6 +298,9 @@ path.join = function join (...parts) {
   })
 })
 
+/**
+ * @returns {{ trustedDependencies: string[], overrides: Record<string, string> }}
+ */
 function readVersionsManifest () {
   return JSON.parse(fs.readFileSync(path.join(versionsDir, 'package.json'), 'utf8'))
 }
@@ -306,7 +309,7 @@ function readVersionsManifest () {
  * @param {string} plugin
  * @param {string} [binDirectory]
  * @param {string} [traceFile]
- * @param {NodeJS.ProcessEnv} [env]
+ * @param {Record<string, string | undefined>} [env]
  * @returns {import('node:child_process').SpawnSyncReturns<string>}
  */
 function runInstall (plugin, binDirectory, traceFile, env) {
@@ -327,7 +330,7 @@ function runInstall (plugin, binDirectory, traceFile, env) {
 
 /**
  * @param {string} plugin
- * @param {NodeJS.ProcessEnv} [env]
+ * @param {Record<string, string | undefined>} [env]
  * @returns {import('node:child_process').SpawnSyncReturns<string>}
  */
 function spawnInstall (plugin, env = {}) {