chore: migrate from yarn to bun

Replace yarn.lock with bun.lock and switch package
manager to bun: package.json scripts and CI workflows now use bun
(oven-sh/setup-bun, bun install --frozen-lockfile, bun run ...). The NR
reusable node-audit workflow runs its bun path via package-manager: bun.
npm publish steps are kept (bun has no publish).

Verified locally: bun install --frozen-lockfile, build/test/lint (and
bun audit where gated) pass; bun.lock is consistent (frozen install
reports no changes).

Signed-off-by: Sebastian Mendel <info@sebastianmendel.de>

Author: CybotTM

.devcontainer/devcontainer.json

@@ -5,7 +5,10 @@
 	"workspaceFolder": "/app",
 	"remoteUser": "node",
 	"workspaceMount": "source=${localWorkspaceFolder},target=/app,type=bind,consistency=cached",
-	"postCreateCommand": "yarn install",
+	"features": {
+		"ghcr.io/shyim/devcontainers-features/bun:0": {}
+	},
+	"postCreateCommand": "bun install",
 	"customizations": {
 		"vscode": {
 			"extensions": ["dbaeumer.vscode-eslint", "esbenp.prettier-vscode"]

.envrc

@@ -5,12 +5,12 @@
 if [ -f package.json ]; then
 	if [ ! -d node_modules ]; then
 		echo "Installing dependencies..."
-		yarn install
+		bun install
 	fi
 
 	# Ensure husky git hooks are configured
 	if [ "$(git config core.hooksPath 2>/dev/null)" != ".husky/_" ]; then
 		echo "Setting up git hooks..."
-		npx husky
+		bunx husky
 	fi
 fi

.github/PULL_REQUEST_TEMPLATE.md

@@ -12,6 +12,6 @@
 
 ## Checklist
 
-- [ ] Lint passes (`yarn lint`)
-- [ ] Build passes (`yarn build:lib`)
+- [ ] Lint passes (`bun run lint`)
+- [ ] Build passes (`bun run build:lib`)
 - [ ] Public API unchanged (or downstream consumers checked)

.github/workflows/AGENTS.md

@@ -24,7 +24,7 @@ GitHub Actions workflows for CI, documentation, and release automation.
 - **Minimal permissions**: Use `permissions:` block, never use `permissions: write-all`
 - **Node version**: 24 (match `engines` in package.json)
 - **Runner**: `ubuntu-24.04` or `ubuntu-latest`
-- **Package manager**: yarn with `--frozen-lockfile` in CI
+- **Package manager**: bun with `--frozen-lockfile` in CI
 
 ### Naming conventions
 

.github/workflows/docs.yml

@@ -30,13 +30,14 @@ jobs:
             - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
               with:
                   node-version: '24'
-                  cache: yarn
+
+            - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
 
             - name: ⚡ Install dependencies
-              run: yarn install --frozen-lockfile
+              run: bun install --frozen-lockfile
 
             - name: 🔨 Build documentation
-              run: yarn build:docs
+              run: bun run build:docs
 
             - name: Upload artifact
               uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0

.github/workflows/lint.and.build.yml

@@ -27,13 +27,14 @@ jobs:
             - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
               with:
                   node-version: 24
-                  cache: yarn
+
+            - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
 
             - name: ⚡ Install dependencies
-              run: yarn install --frozen-lockfile
+              run: bun install --frozen-lockfile
 
             - name: 🔨 Build
-              run: yarn build:lib
+              run: bun run build:lib
 
     test:
         name: 🧪 Test
@@ -43,13 +44,14 @@ jobs:
             - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
               with:
                   node-version: 24
-                  cache: yarn
+
+            - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
 
             - name: ⚡ Install dependencies
-              run: yarn install --frozen-lockfile
+              run: bun install --frozen-lockfile
 
             - name: 🧪 Test
-              run: yarn test:coverage
+              run: bun run test:coverage
 
     lint:
         name: 🔎 Lint
@@ -59,10 +61,11 @@ jobs:
             - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
               with:
                   node-version: 24
-                  cache: yarn
+
+            - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
 
             - name: ⚡ Install dependencies
-              run: yarn install --frozen-lockfile
+              run: bun install --frozen-lockfile
 
             - name: 🔎 Lint
-              run: yarn lint
+              run: bun run lint

.github/workflows/release.when-tagged.yml

@@ -34,13 +34,14 @@ jobs:
                   node-version: 24
                   registry-url: 'https://registry.npmjs.org'
                   scope: '@netresearch'
-                  cache: yarn
+
+            - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
 
             - name: ⚡ Install dependencies
-              run: yarn install --frozen-lockfile
+              run: bun install --frozen-lockfile
 
             - name: 🔨 Build
-              run: yarn build:lib
+              run: bun run build:lib
 
             - name: ☁️ Publish to NPM (OIDC + provenance)
               run: npm publish --access=public --provenance

.github/workflows/security.yml

@@ -10,32 +10,32 @@ name: Security
 # netresearch/.github's go-app / php-module templates.
 
 on:
-  push:
-    branches: [main, master]
-  pull_request:
+    push:
+        branches: [main, master]
+    pull_request:
 
 permissions: {}
 
 jobs:
-  gitleaks:
-    uses: netresearch/.github/.github/workflows/gitleaks.yml@main
-    permissions:
-      contents: read
-      security-events: write
-    secrets:
-      GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE }}
+    gitleaks:
+        uses: netresearch/.github/.github/workflows/gitleaks.yml@main
+        permissions:
+            contents: read
+            security-events: write
+        secrets:
+            GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE }}
 
-  dependency-review:
-    if: github.event_name == 'pull_request'
-    uses: netresearch/.github/.github/workflows/dependency-review.yml@main
-    permissions:
-      contents: read
-      pull-requests: write
+    dependency-review:
+        if: github.event_name == 'pull_request'
+        uses: netresearch/.github/.github/workflows/dependency-review.yml@main
+        permissions:
+            contents: read
+            pull-requests: write
 
-  node-audit:
-    uses: netresearch/.github/.github/workflows/node-audit.yml@main
-    permissions:
-      contents: read
-    with:
-      package-manager: yarn
-      audit-level: high
+    node-audit:
+        uses: netresearch/.github/.github/workflows/node-audit.yml@main
+        permissions:
+            contents: read
+        with:
+            package-manager: bun
+            audit-level: high

.husky/pre-commit

@@ -1 +1 @@
-npx lint-staged
+bunx lint-staged

.vscode/launch.json

@@ -1,12 +1,12 @@
 {
-    "version": "0.2.0",
-    "configurations": [
-        {
-            "type": "node-terminal",
-            "name": "Run Script: test",
-            "request": "launch",
-            "command": "yarn run test",
-            "cwd": "${workspaceFolder}"
-        }
-    ]
-}
+	"version": "0.2.0",
+	"configurations": [
+		{
+			"type": "node-terminal",
+			"name": "Run Script: test",
+			"request": "launch",
+			"command": "bun run test",
+			"cwd": "${workspaceFolder}"
+		}
+	]
+}