chore(security): cool down npm installs and freeze the dev lockfile

.agents/skills/apm-integrations/SKILL.md

@@ -135,7 +135,7 @@ Follow these steps when creating or modifying an integration:
 5. **Write tests** — Add unit tests and ESM integration tests. See [Testing](references/testing.md) for templates.
 6. **Run tests** — Validate with:
    ```bash
-   # Run plugin tests (preferred CI command — handles yarn services automatically)
+   # Run plugin tests (preferred CI command — handles `npm run services` automatically)
    PLUGINS="<name>" npm run test:plugins:ci
 
    # If the plugin needs external services (databases, message brokers, etc.),

.agents/skills/apm-integrations/references/new-integration-guide.md

@@ -262,7 +262,7 @@ Add to `.github/workflows/apm-integrations.yml`:
       with:
         version: ${{ matrix.node-version }}
     - uses: ./.github/actions/install
-    - run: yarn test:plugins:ci
+    - run: npm run test:plugins:ci
   strategy:
     matrix:
       node-version: [18, 22]
@@ -278,7 +278,7 @@ See [Testing](testing.md) for complete templates.
 **ESM integration tests** — `packages/datadog-plugin-<name>/test/integration-test/`
 
 ```bash
-# CI command (preferred) — handles dependency installation via yarn services
+# CI command (preferred) — handles dependency installation via `npm run services`
 PLUGINS="<name>" npm run test:plugins:ci
 ```
 

.agents/skills/apm-integrations/references/testing.md

@@ -191,13 +191,13 @@ describe('esm', () => {
 
 ## Running Tests
 
-dd-trace uses a non-standard dependency installation for plugin tests. Libraries under test are installed per-version via `yarn services`, not through the normal `node_modules`. The `:ci` script handles this automatically.
+dd-trace uses a non-standard dependency installation for plugin tests. Libraries under test are installed per-version via `npm run services` (which drives `scripts/install_plugin_modules.js` and a bun isolated install per sandbox), not through the normal `node_modules`. The `:ci` script handles this automatically.
 
 ```bash
-# CI command (preferred) — runs yarn services for dependency installation, then tests
+# CI command (preferred) — runs `npm run services` for dependency installation, then tests
 PLUGINS="<name>" npm run test:plugins:ci
 
-# Unit tests only (assumes yarn services already ran)
+# Unit tests only (assumes `npm run services` already ran)
 PLUGINS="<name>" npm run test:plugins
 
 # With external services (e.g., databases, message brokers)

.cursor/worktrees.json

@@ -1,5 +1,5 @@
 {
   "scripts": {
-    "postCreate": "yarn install"
+    "postCreate": "bun install"
   }
 }

.github/CODEOWNERS

@@ -255,6 +255,8 @@
 /.github/workflows/aiguard.yml @DataDog/asm-js
 /.github/workflows/appsec.yml @DataDog/asm-js
 /.github/workflows/debugger.yml @DataDog/debugger-nodejs
+/.github/workflows/install-smoke.yml @DataDog/lang-platform-js
+/docs/ @DataDog/lang-platform-js
 /.github/workflows/instrumentation.yml @DataDog/apm-idm-js
 /.github/workflows/electron.yml @DataDog/apm-idm-js
 /.github/workflows/serverless.yml @DataDog/serverless-aws @DataDog/apm-serverless

.github/actions/datadog-ci/action.yml

@@ -8,14 +8,20 @@ runs:
       with:
         node-version: '20'
 
+    # Stay on npm here so the action works in container jobs that lack `unzip`
+    # (the playwright matrix runs in `ghcr.io/datadog/dd-trace-js/playwright-tools`,
+    # which ships without it and breaks `oven-sh/setup-bun`). `npm ci` consumes
+    # the committed `package-lock.json`, pinning the tarball integrity hash so a
+    # republished `@datadog/datadog-ci` at the same version number cannot land
+    # without an explicit lockfile update.
     - uses: nick-fields/retry@ad984534de44a9489a53aefd81eb77f87c70dc60 # v4.0.0
       with:
         max_attempts: 3
         timeout_minutes: 5
         retry_wait_seconds: 30
         command: |
           cd ${{ github.workspace }}/.github/actions/datadog-ci
-          yarn install --frozen-lockfile
+          npm ci --ignore-scripts --no-audit --no-fund
 
     - shell: bash
       run: echo "${{ github.workspace }}/.github/actions/datadog-ci/node_modules/.bin" >> $GITHUB_PATH

.github/actions/install/action.yml

@@ -1,13 +1,48 @@
 name: Install dependencies
 description: Install dependencies
+inputs:
+  cache:
+    description: Restore and save the bun-install output tar between runs of this workflow/job.
+    required: false
+    default: 'false'
 runs:
   using: composite
   steps:
-    - uses: nick-fields/retry@ad984534de44a9489a53aefd81eb77f87c70dc60 # v4.0.0
+    - id: install-cache
+      if: inputs.cache == 'true'
+      uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+      with:
+        # `bun install` runs `prepare`, which `cd vendor && npm ci --include=dev` runs
+        # `node rspack` and lands the bundled artefacts under `vendor/dist`. Both
+        # `vendor/package-lock.json` and `bun.lock` feed the install graph, so the cache
+        # key has to invalidate when either moves.
+        key: install-cache-${{ github.workflow }}-${{ github.job }}-${{ hashFiles('bun.lock', 'vendor/package-lock.json') }}-v3
+        path: install-cache.tar
+    - if: inputs.cache == 'true' && steps.install-cache.outputs.cache-hit == 'true'
+      shell: bash
+      run: tar -xf install-cache.tar
+    - if: inputs.cache != 'true' || steps.install-cache.outputs.cache-hit != 'true'
+      uses: nick-fields/retry@ad984534de44a9489a53aefd81eb77f87c70dc60 # v4.0.0
       env:
         _DD_IGNORE_ENGINES: 'true'
       with:
         max_attempts: 3
         timeout_minutes: 5
         retry_wait_seconds: 30
-        command: bun install --linker=hoisted --trust --network-concurrency 8
+        # `--frozen-lockfile` makes CI fail the install step when `bun.lock` and
+        # `package.json` disagree (typical Dependabot bump, contributor who
+        # edited `package.json` without re-running `bun install`). Without it,
+        # the install would silently resolve fresh against the registry and the
+        # supply-chain pin in `bunfig.toml` (`minimumReleaseAge`) would be the
+        # only thing left protecting that run. The four native packages that
+        # need their `install` script to fetch the prebuilt binary live in
+        # `trustedDependencies` in `package.json` — the CLI's `--trust` flag is
+        # mutually exclusive with `--frozen-lockfile`, so the trust list has to
+        # be declarative.
+        command: bun install --frozen-lockfile --linker=hoisted --network-concurrency 8
+    - if: inputs.cache == 'true' && steps.install-cache.outputs.cache-hit != 'true'
+      shell: bash
+      # `node_modules` alone misses `vendor/dist/*` (produced by the rspack postinstall)
+      # and `vendor/node_modules` (needed for it to re-run on the next miss); without
+      # them, every cache-hit job fails to require `vendor/dist/limiter` and friends.
+      run: tar -cf install-cache.tar node_modules vendor/node_modules vendor/dist

.github/actions/instrumentations/test/action.yml

@@ -7,10 +7,10 @@ runs:
       id: dd-sts
     - uses: ./.github/actions/node/oldest-maintenance-lts
     - uses: ./.github/actions/install
-    - run: yarn test:instrumentations:ci
+    - run: npm run test:instrumentations:ci
       shell: bash
     - uses: ./.github/actions/node/latest
-    - run: yarn test:instrumentations:ci
+    - run: npm run test:instrumentations:ci
       shell: bash
     - uses: ./.github/actions/coverage
       with:

.github/actions/plugins/integration-test-newest-lts/action.yml

@@ -12,7 +12,7 @@ runs:
       id: dd-sts
     - uses: ./.github/actions/node/newest-maintenance-lts
     - uses: ./.github/actions/install
-    - run: yarn test:integration:plugins:coverage
+    - run: npm run test:integration:plugins:coverage
       shell: bash
     - uses: ./.github/actions/coverage
       with:

.github/actions/plugins/integration-test/action.yml

@@ -8,10 +8,10 @@ runs:
     - uses: ./.github/actions/testagent/start
     - uses: ./.github/actions/node/oldest-maintenance-lts
     - uses: ./.github/actions/install
-    - run: yarn test:integration:plugins:coverage
+    - run: npm run test:integration:plugins:coverage
       shell: bash
     - uses: ./.github/actions/node/latest
-    - run: yarn test:integration:plugins:coverage
+    - run: npm run test:integration:plugins:coverage
       shell: bash
     - uses: ./.github/actions/coverage
       with:

.github/actions/plugins/test-and-upstream/action.yml

@@ -15,14 +15,14 @@ runs:
     - if: ${{ inputs.node-floor == 'newest-maintenance-lts' }}
       uses: ./.github/actions/node/newest-maintenance-lts
     - uses: ./.github/actions/install
-    - run: yarn test:plugins:ci
+    - run: npm run test:plugins:ci
       shell: bash
-    - run: yarn test:plugins:upstream
+    - run: npm run test:plugins:upstream
       shell: bash
     - uses: ./.github/actions/node/latest
-    - run: yarn test:plugins:ci
+    - run: npm run test:plugins:ci
       shell: bash
-    - run: yarn test:plugins:upstream
+    - run: npm run test:plugins:upstream
       shell: bash
     - uses: ./.github/actions/coverage
       with:

.github/actions/plugins/test/action.yml

@@ -15,10 +15,10 @@ runs:
     - if: ${{ inputs.node-floor == 'newest-maintenance-lts' }}
       uses: ./.github/actions/node/newest-maintenance-lts
     - uses: ./.github/actions/install
-    - run: yarn test:plugins:ci
+    - run: npm run test:plugins:ci
       shell: bash
     - uses: ./.github/actions/node/latest
-    - run: yarn test:plugins:ci
+    - run: npm run test:plugins:ci
       shell: bash
     - uses: ./.github/actions/coverage
       with:

.github/actions/plugins/upstream/action.yml

@@ -15,10 +15,10 @@ runs:
     - if: ${{ inputs.node-floor == 'newest-maintenance-lts' }}
       uses: ./.github/actions/node/newest-maintenance-lts
     - uses: ./.github/actions/install
-    - run: yarn test:plugins:upstream
+    - run: npm run test:plugins:upstream
       shell: bash
     - uses: ./.github/actions/node/latest
-    - run: yarn test:plugins:upstream
+    - run: npm run test:plugins:upstream
       shell: bash
     # `test:plugins:upstream` runs each plugin's upstream test suite (e.g., axios's own tests)
     # against the unit-test harness, which intentionally does not produce NYC coverage for

.github/workflows/aiguard.yml

@@ -23,7 +23,7 @@ jobs:
         id: dd-sts
       - uses: ./.github/actions/node/latest
       - uses: ./.github/actions/install
-      - run: yarn test:aiguard:ci
+      - run: npm run test:aiguard:ci
       - uses: ./.github/actions/coverage
         with:
           flags: aiguard-macos
@@ -44,13 +44,13 @@ jobs:
         id: dd-sts
       - uses: ./.github/actions/node/oldest-maintenance-lts
       - uses: ./.github/actions/install
-      - run: yarn test:aiguard:ci
+      - run: npm run test:aiguard:ci
       - uses: ./.github/actions/node/newest-maintenance-lts
-      - run: yarn test:aiguard:ci
+      - run: npm run test:aiguard:ci
       - uses: ./.github/actions/node/active-lts
-      - run: yarn test:aiguard:ci
+      - run: npm run test:aiguard:ci
       - uses: ./.github/actions/node/latest
-      - run: yarn test:aiguard:ci
+      - run: npm run test:aiguard:ci
       - uses: ./.github/actions/coverage
         with:
           flags: aiguard-ubuntu
@@ -73,7 +73,9 @@ jobs:
         with:
           version: 24.14.1 # TODO: remove pin when https://github.com/nodejs/node/issues/62991 is fixed
       - uses: ./.github/actions/install
-      - run: yarn test:aiguard:ci
+        with:
+          cache: "true"
+      - run: npm run test:aiguard:ci
       - uses: ./.github/actions/node-crash-report
         if: failure()
       - uses: ./.github/actions/coverage
@@ -102,7 +104,7 @@ jobs:
         with:
           version: ${{ matrix.version }}
       - uses: ./.github/actions/install
-      - run: yarn test:integration:aiguard:coverage
+      - run: npm run test:integration:aiguard:coverage
       - uses: ./.github/actions/coverage
         with:
           flags: aiguard-integration-${{ matrix.version }}

.github/workflows/all-green.yml

@@ -31,7 +31,7 @@ jobs:
       - uses: ./.github/actions/node
         with:
           version: active
-      - run: yarn add @actions/core @actions/github octokit
+      - run: bun install @actions/core @actions/github octokit
       - run: node scripts/all-green.mjs
         env:
           DELAY: ${{ github.run_attempt == 1 && '5' || '0' }} # 5 minutes on first attempt, no delay on reruns

.github/workflows/apm-capabilities.yml

@@ -31,7 +31,7 @@ jobs:
         id: dd-sts
       - uses: ./.github/actions/node/latest
       - uses: ./.github/actions/install
-      - run: yarn test:trace:core:ci
+      - run: npm run test:trace:core:ci
       - uses: ./.github/actions/coverage
         with:
           flags: apm-capabilities-tracing-macos
@@ -57,7 +57,7 @@ jobs:
         with:
           version: ${{ matrix.node-version }}
       - uses: ./.github/actions/install
-      - run: yarn test:trace:core:ci
+      - run: npm run test:trace:core:ci
       - uses: ./.github/actions/coverage
         with:
           flags: apm-capabilities-tracing-ubuntu-${{ matrix.node-version }}
@@ -79,7 +79,9 @@ jobs:
         with:
           version: 24.14.1 # TODO: remove pin when https://github.com/nodejs/node/issues/62991 is fixed
       - uses: ./.github/actions/install
-      - run: yarn test:trace:core:ci
+        with:
+          cache: "true"
+      - run: npm run test:trace:core:ci
       - uses: ./.github/actions/node-crash-report
         if: failure()
       - uses: ./.github/actions/coverage