Merge branch 'main' into revert-qvac-17869-parakeet-ggml

Author: GustavoA1604

.github/workflows/docs-api-pipeline-e2e.yml

@@ -38,7 +38,10 @@ jobs:
 
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # 2.2.0
         with:
-          bun-version: latest
+          # Pinned (vs `latest`) so a compromised Bun release can't be picked
+          # up automatically on the next CI run. Keep in sync with the
+          # `bun: ^1.3.11` devDep in docs/website/package.json.
+          bun-version: 1.3.11
 
       - name: Install docs website deps
         run: bun install

.github/workflows/docs-ci-doctor.yml

@@ -1,6 +1,6 @@
 # Gate merges to docs-production by verifying all docs-related CI workflows are green.
 # Runs on PRs targeting docs-production (i.e. main -> docs-production).
-# See docs/docs-workflow.md for the full deploy strategy.
+# See docs/website/docs-workflow.md for the full deploy strategy.
 name: Docs CI Doctor
 
 on:

.github/workflows/docs-generate-api.yml

@@ -83,6 +83,11 @@ jobs:
 
       - name: Setup Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # 2.2.0
+        with:
+          # Pinned (vs implicit `latest`) so a compromised Bun release can't
+          # be picked up automatically. Keep in sync with the `bun: ^1.3.11`
+          # devDep in docs/website/package.json.
+          bun-version: 1.3.11
 
       - name: Install dependencies (docs)
         working-directory: ${{ env.DOCS_DIR }}

.github/workflows/docs-post-merge-sync.yml

@@ -50,6 +50,11 @@ jobs:
 
       - name: Setup Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # 2.2.0
+        with:
+          # Pinned (vs implicit `latest`) so a compromised Bun release can't
+          # be picked up automatically. Keep in sync with the `bun: ^1.3.11`
+          # devDep in docs/website/package.json.
+          bun-version: 1.3.11
 
       - name: Install docs dependencies
         working-directory: docs/website

.github/workflows/docs-release-pipeline.yml

@@ -140,6 +140,11 @@ jobs:
 
       - name: Setup Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # 2.2.0
+        with:
+          # Pinned (vs implicit `latest`) so a compromised Bun release can't
+          # be picked up automatically. Keep in sync with the `bun: ^1.3.11`
+          # devDep in docs/website/package.json.
+          bun-version: 1.3.11
 
       - name: Install docs dependencies
         working-directory: main-tree/${{ env.DOCS_DIR }}

.github/workflows/docs-website-pr-checks.yml

@@ -28,7 +28,10 @@ jobs:
 
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # 2.2.0
         with:
-          bun-version: latest
+          # Pinned (vs `latest`) so a compromised Bun release can't be picked
+          # up automatically on the next CI run, including for fork PRs.
+          # Keep in sync with the `bun: ^1.3.11` devDep in docs/website/package.json.
+          bun-version: 1.3.11
 
       - name: Install dependencies
         run: bun install

CONTRIBUTING.md

@@ -12,7 +12,7 @@ npm install
 npm run docs:generate-api -- 0.9.1 --latest  # writes content/docs/sdk/api/index.mdx
 ```
 
-Full workflow, CLI flags, AI augmentation, determinism guarantees, and troubleshooting are documented in [docs/docs-workflow.md](docs/docs-workflow.md). `docs:generate-api` requires `bun` on PATH (listed as a devDependency of `docs/website`).
+Full workflow, CLI flags, AI augmentation, determinism guarantees, and troubleshooting are documented in [docs/website/docs-workflow.md](docs/website/docs-workflow.md). `docs:generate-api` requires `bun` on PATH (listed as a devDependency of `docs/website`).
 
 ## PR Labels
 

docs/docs-workflow.md docs/website/docs-workflow.mddocs/docs-workflow.md renamed to docs/website/docs-workflow.md

@@ -2,7 +2,7 @@
 
 How the documentation site works: architecture, local development, CI, deployment, and troubleshooting.
 
-For general contribution guidelines (PR labels, changelog format), see the [root CONTRIBUTING.md](../CONTRIBUTING.md).
+For general contribution guidelines (PR labels, changelog format), see the [root CONTRIBUTING.md](../../CONTRIBUTING.md).
 
 ---