ci(audit): restore strict Bun advisory policy

.agents/skills/apm-integrations/SKILL.md

@@ -170,7 +170,7 @@ Follow these steps when creating or modifying an integration:
 6. **Run tests** — Validate with:
 
     ```bash
-    # Run plugin tests (preferred CI command — handles yarn services automatically)
+    # Run plugin tests (preferred CI command — handles `npm run services` automatically)
     PLUGINS="<name>" npm run test:plugins:ci
 
     # If the plugin needs external services (databases, message brokers, etc.),

.agents/skills/apm-integrations/references/new-integration-guide.md

@@ -285,7 +285,7 @@ See [Testing](testing.md) for complete templates.
 **ESM integration tests** — `packages/datadog-plugin-<name>/test/integration-test/`
 
 ```bash
-# CI command (preferred) — handles dependency installation via yarn services
+# CI command (preferred) — handles dependency installation via `npm run services`
 PLUGINS="<name>" npm run test:plugins:ci
 ```
 

.agents/skills/apm-integrations/references/orchestrion.md

@@ -8,7 +8,7 @@ source hooks, ESM support, and avoiding runtime monkey-patching.
 Engine: `@apm-js-collab/code-transformer` (mirror of
 [nodejs/orchestrion-js](https://github.com/nodejs/orchestrion-js)), vendored at
 `vendor/dist/@apm-js-collab/code-transformer/`. Installed version is in
-`vendor/package-lock.json`.
+`vendor/bun.lock`.
 
 > **Verify before relying on a field/transform.** The engine is actively
 > developed and the config surface changes between releases. This doc tracks

.agents/skills/apm-integrations/references/testing.md

@@ -191,13 +191,13 @@ describe('esm', () => {
 
 ## Running Tests
 
-dd-trace uses a non-standard dependency installation for plugin tests. Libraries under test are installed per-version via `yarn services`, not through the normal `node_modules`. The `:ci` script handles this automatically.
+dd-trace uses a non-standard dependency installation for plugin tests. Libraries under test are installed per-version via `npm run services` (which drives `scripts/install_plugin_modules.js` and a bun isolated install per sandbox), not through the normal `node_modules`. The `:ci` script handles this automatically.
 
 ```bash
-# CI command (preferred) — runs yarn services for dependency installation, then tests
+# CI command (preferred) — runs `npm run services` for dependency installation, then tests
 PLUGINS="<name>" npm run test:plugins:ci
 
-# Unit tests only (assumes yarn services already ran)
+# Unit tests only (assumes `npm run services` already ran)
 PLUGINS="<name>" npm run test:plugins
 
 # With external services (e.g., databases, message brokers)

.agents/skills/llmobs-testing/references/vcr-cassettes.md

@@ -79,7 +79,7 @@ npm run test:llmobs:sdk                      # everything except the plugin spec
 `packages/dd-trace/test/llmobs/plugins/@(${PLUGINS})/*.spec.js`.
 
 `Cannot find module '…/versions/<package>@<version>'` is a missing version fixture, not a broken spec:
-`PLUGINS=<integration> yarn services` installs it. The error names the npm package while `PLUGINS` takes
+`PLUGINS=<integration> npm run services` installs it. The error names the npm package while `PLUGINS` takes
 the integration key, which is the file name under `packages/datadog-instrumentations/src/` — so
 `@anthropic-ai/sdk` is `anthropic` and `@google/genai` is `google-genai`. The fixtures live in a gitignored
 `versions/` directory at the repo root, so a fresh worktree has none of them.

.cursor/worktrees.json

@@ -1,5 +1,5 @@
 {
   "scripts": {
-    "postCreate": "yarn install"
+    "postCreate": "bun install"
   }
 }

.github/CODEOWNERS

@@ -4,6 +4,7 @@
 /.agents/ @DataDog/lang-platform-js
 /.claude/ @DataDog/lang-platform-js
 /.github/actions/ @DataDog/lang-platform-js
+/.github/audit-allowlist.json @DataDog/lang-platform-js
 /.github/ISSUE_TEMPLATE/ @DataDog/lang-platform-js
 /.gitlab/ @DataDog/lang-platform-js
 /.husky/ @DataDog/lang-platform-js
@@ -110,6 +111,7 @@
 /packages/dd-trace/src/propagation-hash/ @DataDog/apm-idm-js
 /packages/dd-trace/test/plugins/ @DataDog/apm-idm-js
 /packages/dd-trace/test/process-tags.spec.js @DataDog/apm-idm-js
+/versions/bunfig.toml @DataDog/lang-platform-js
 /packages/dd-trace/src/service-naming/ @DataDog/apm-idm-js
 /packages/dd-trace/test/service-naming/ @DataDog/apm-idm-js
 /packages/dd-trace/test/payload_tagging.spec.js @DataDog/apm-idm-js
@@ -327,6 +329,7 @@
 # CI
 /.github/actions/upload-coverage-artifact/ @DataDog/ci-app-libraries
 /.github/actions/upload-junit-artifacts/ @DataDog/ci-app-libraries
+/.github/all-green/ @DataDog/lang-platform-js
 /.github/editorconfig-checker/ @Datadog/lang-platform-js
 /.github/playwright/ @DataDog/ci-app-libraries
 /.github/selenium/ @DataDog/ci-app-libraries
@@ -382,6 +385,9 @@
 /.github/pull_request_template.md @DataDog/lang-platform-js
 /.github/vendored-dependencies.csv @DataDog/lang-platform-js
 
+/docs/bun.lock @DataDog/lang-platform-js
+/vendor/bun.lock @DataDog/lang-platform-js
+
 /benchmark/* @DataDog/lang-platform-js
 /benchmark/openfeature.js @DataDog/lang-platform-js @DataDog/feature-flagging-and-experimentation-sdk
 /benchmark/sirun/* @DataDog/lang-platform-js

.github/actions/datadog-ci/action.yml

@@ -8,14 +8,16 @@ runs:
       with:
         node-version: '20'
 
+    # The repository's Node setup installs Bun through npm, so this also works in
+    # container jobs without `unzip`.
     - uses: nick-fields/retry@ad984534de44a9489a53aefd81eb77f87c70dc60 # v4.0.0
       with:
         max_attempts: 3
         timeout_minutes: 5
         retry_wait_seconds: 30
         command: |
           cd ${{ github.workspace }}/.github/actions/datadog-ci
-          yarn install --frozen-lockfile
+          bun --config="${{ github.workspace }}/bunfig.toml" install --frozen-lockfile --ignore-scripts
 
     - shell: bash
       run: echo "${{ github.workspace }}/.github/actions/datadog-ci/node_modules/.bin" >> $GITHUB_PATH

.github/actions/install/action.yml

@@ -5,7 +5,11 @@ runs:
   steps:
     - uses: nick-fields/retry@ad984534de44a9489a53aefd81eb77f87c70dc60 # v4.0.0
       with:
-        max_attempts: 3
+        max_attempts: 2
         timeout_minutes: 5
         retry_wait_seconds: 30
-        command: bun install --linker=hoisted --trust --network-concurrency 8
+        shell: bash
+        # A retry against Bun's partial install state can skip lifecycle scripts. Start every attempt clean.
+        command: >-
+          node -e "require('node:fs').rmSync('node_modules', { recursive: true, force: true })" &&
+          bun install --frozen-lockfile --linker=hoisted --network-concurrency 8

.github/actions/node/setup/action.yml

@@ -81,7 +81,12 @@ runs:
       run: |
         MAJOR=$(node -e "process.stdout.write(String(parseInt(process.versions.node)))")
         echo "supported=$([ "$MAJOR" -ge 12 ] && echo true || echo false)" >> "$GITHUB_OUTPUT"
+    # `scripts/bun.js` bootstraps the pinned version locally whenever the global one differs, so a
+    # hard-coded version here would not run the wrong Bun — it would just make every job pay for that
+    # bootstrap once Dependabot bumps the devDependency. Read the pin instead of restating it.
     - name: Install Bun
       if: steps.bun-check.outputs.supported == 'true'
       shell: bash
-      run: npm install -g bun@1.3.1 --prefer-offline --no-audit --no-fund
+      run: |
+        VERSION=$(node -p "require('./package.json').devDependencies.bun")
+        npm install -g "bun@$VERSION" --prefer-offline --no-audit --no-fund

.github/all-green/package.json

@@ -0,0 +1,9 @@
+{
+  "name": "dd-trace-js-all-green",
+  "private": true,
+  "dependencies": {
+    "@actions/core": "^3.0.1",
+    "@actions/github": "^9.1.1",
+    "octokit": "^5.0.3"
+  }
+}

.github/audit-allowlist.json

@@ -0,0 +1,21 @@
+{
+  ".": {
+    "allow": [
+      {
+        "id": "GHSA-5c6j-r48x-rmvq",
+        "package": "serialize-javascript",
+        "reason": "Patched in 7.0.3, but mocha declares serialize-javascript@^6.0.2. The vulnerable path is limited to mocha's dev-only parallel test metadata until mocha widens its range."
+      }
+    ]
+  },
+  "vendor": {
+    "level": "moderate",
+    "allow": [
+      {
+        "id": "GHSA-8988-4f7v-96qf",
+        "package": "@opentelemetry/core",
+        "reason": "Patched in 2.8.0, outside the OpenTelemetry 1.x compatibility range bundled for customers. Clearing it requires a deliberate vendored OpenTelemetry major upgrade."
+      }
+    ]
+  }
+}