ci: pin bun and npm versions, update trusted publishing

- Pin bun to 1.3.5 across all workflows
- Pin npm to 11.7.0 for OIDC trusted publishing support
- Update GitHub Actions to latest SHA-pinned versions

Author: hatemosphere

.github/workflows/ci-check.yaml

@@ -20,7 +20,7 @@ jobs:
       - name: Setup Bun
         uses: oven-sh/setup-bun@735343b667d3e6f658f44d0eca948eb6282f2b76 # v2.0.2
         with:
-          bun-version: 'latest'
+          bun-version: '1.3.5'
 
       - name: Install deps
         run: bun install

.github/workflows/ci-release.yaml

@@ -90,21 +90,23 @@ jobs:
     if: ${{ inputs.skip_publish != 'true' }}
     permissions:
       contents: read
-      id-token: write  # Required for npm provenance / trusted publishing
+      id-token: write  # Required for npm OIDC trusted publishing
 
     steps:
       - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
       - name: Setup Bun
         uses: oven-sh/setup-bun@735343b667d3e6f658f44d0eca948eb6282f2b76 # v2.0.2
         with:
-          bun-version: 'latest'
+          bun-version: '1.3.5'
 
       - uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6.1.0
         with:
           node-version: 22.x
           registry-url: 'https://registry.npmjs.org'
-          scope: '@matterlabs'
+
+      - name: Upgrade npm for OIDC support
+        run: npm install -g npm@11.7.0
 
       - run: bun install
 

.github/workflows/ci-test.yaml

@@ -19,7 +19,7 @@ jobs:
       - name: Setup Bun
         uses: oven-sh/setup-bun@735343b667d3e6f658f44d0eca948eb6282f2b76 # v2.0.2
         with:
-          bun-version: 'latest'
+          bun-version: '1.3.5'
 
       - name: Install deps
         run: bun install
@@ -50,7 +50,7 @@ jobs:
       - name: Setup Bun
         uses: oven-sh/setup-bun@735343b667d3e6f658f44d0eca948eb6282f2b76 # v2.0.2
         with:
-          bun-version: 'latest'
+          bun-version: '1.3.5'
 
       - name: Install deps
         run: bun install --frozen-lockfile