test(scripts): resolve bun via PATH lookup in the sandbox-install guard

The `installs every pino sandbox ...` regression guard forwards a
constrained `PATH` to the spawned `install_plugin_modules.js` so a
re-introduced `yarn` invocation fails closed. The PATH it built started
with `~/.bun/bin`, but the node composite action installs bun through
`npm install -g bun@<ver>`; the binary lands under `npm prefix -g`,
not under `~/.bun`. Every `spawn('bun', …)` in the child returned
`ENOENT`, the install script exited with an empty stderr that hid the
cause, and `Sandbox install (pino)` failed on the assert. Resolve bun's
actual location via `command -v bun`, with a `BUN_BIN` override for
unusual layouts.

Drive-by fix:

* Rewrite the `patch-istanbul-lib-coverage.js` doc comment to drop a
  stray `yarn upgrade` mention (no yarn invocation, purely cosmetic) and
  allowlist `scripts/verify-exercised-tests.js` in the no-yarn spec —
  its `indexOf('yarn ')` is structural workflow-string parsing, not a
  yarn invocation.

Author: BridgeAR

scripts/patch-istanbul-lib-coverage.js

@@ -13,8 +13,8 @@
  *
  * Idempotent — applies the change once, then no-ops while the sentinel
  * comment is present in the file. Fails loudly if the locked upstream code
- * shape changes so a future yarn upgrade can't silently leave the patch
- * unapplied.
+ * shape changes so a future dependency upgrade can't silently leave the
+ * patch unapplied.
  *
  * Wired to the `prepare` lifecycle so the script never fires on consumer
  * installs of the published tarball — the script itself is not in the

scripts/test/install-plugin-modules.spec.js

@@ -9,7 +9,6 @@ const assert = require('node:assert/strict')
 const { spawnSync } = require('node:child_process')
 const fs = require('node:fs')
 const { createRequire } = require('node:module')
-const os = require('node:os')
 const path = require('node:path')
 
 // eslint-disable-next-line n/no-restricted-require
@@ -18,7 +17,12 @@ const semver = require('semver')
 const repoRoot = path.resolve(__dirname, '..', '..')
 const installScript = path.join(repoRoot, 'scripts', 'install_plugin_modules.js')
 const versionsDir = path.join(repoRoot, 'versions')
-const bunBinDir = path.join(os.homedir(), '.bun', 'bin')
+// Resolve the runtime location of bun. CI installs bun two different ways (the official
+// `~/.bun/bin/bun` install script on dev machines and `npm install -g bun@<ver>` in the
+// `actions/node` composite, which lands it under `npm prefix -g`), so a hard-coded path
+// would silently fail on whichever environment doesn't match. Honour `BUN_BIN` for
+// explicit overrides, fall back to a `which bun` lookup against the current PATH.
+const bunBinDir = path.dirname(resolveBunBinary())
 
 describe('scripts/install_plugin_modules.js', function () {
   this.timeout(180_000)
@@ -79,3 +83,11 @@ describe('scripts/install_plugin_modules.js', function () {
     assert.deepStrictEqual(resolvedVersions, expectedVersions)
   })
 })
+
+function resolveBunBinary () {
+  if (process.env.BUN_BIN) return process.env.BUN_BIN
+  const result = spawnSync('sh', ['-c', 'command -v bun'], { encoding: 'utf8' })
+  const located = result.stdout.trim()
+  assert.ok(located, `could not locate bun on PATH (stderr: ${result.stderr.trim()})`)
+  return located
+}

scripts/test/no-yarn-dev-references.spec.js

@@ -20,6 +20,13 @@ const ALLOWLIST_EXACT = new Set([
   'requirements.json',
   '.gitlab/requirements_block.json',
 
+  // CI scaffolding: verify-exercised-tests parses workflow `run:` strings and unwraps the
+  // `nick-fields/retry` wrapper. It still has to find where the wrapped command starts past
+  // any inline env-assignment prefix, and a stray `yarn` invocation in a future workflow has
+  // to be recognised so the assignments before it get attributed correctly. The detection is
+  // structural, not an invocation — there is no `yarn` process spawned by this script.
+  'scripts/verify-exercised-tests.js',
+
   // User-PM test fixtures: yarn runs as the user's package manager inside the sandbox under test.
   'packages/dd-trace/test/appsec/next.utils.js',
   'integration-tests/esbuild/openfeature.spec.js',