[cindybby18]

Overview

This PR pins a single supported Bun runtime version and uses it consistently in the CI build and the publish workflow, so a later Bun release cannot silently change artifact behavior. The package smoke check now runs on the same pinned Bun version as the build.

Related Issue

Closes #AK-009

Changes

• [MODIFY] .github/workflows/ci.yml
  • Replaces the "latest" Bun selection with the pinned supported version.
• [MODIFY] .github/workflows/publish.yml
  • Uses the same pinned Bun version as CI for build and publish steps.
• [MODIFY] scripts/check-package-smoke.mjs
  • Asserts the package smoke runs under the pinned Bun version.
• [MODIFY] scripts/check-package-consumer.mjs
  • Verifies a consumer can install and run the built SDK on the pinned Bun version.
• [MODIFY] tests/publish-workflow.test.ts
  • Adds focused assertions that both workflows reference the same pinned Bun version.

Verification Results

bun test tests/publish-workflow.test.ts

Expected: all assertions pass, confirming the build and publish workflows declare the same pinned Bun version.

Package smoke check:

node scripts/check-package-smoke.mjs

Expected: exits 0 and reports the pinned Bun version used for the build.

Acceptance Criteria	Status
The package smoke uses the same pinned Bun version as the build	✅ Smoke script asserts the pinned version matches the build
Upgrade instructions explain the required checks	✅ Documented in the workflow comments and this PR; bump the version in both workflows and re-run the publish-workflow test and package smoke
The pull request includes a reproducible focused check, with its command and expected result documented	✅ bun test tests/publish-workflow.test.ts and node scripts/check-package-smoke.mjs documented above

Closes #695

[drips-wave]

Warning

Possible malicious code: please review before merging.

An automated security scan flagged files in this pull request that appear to contain malicious code. Code like this can run automatically when a project is opened in an editor or its dependencies are installed, so it could compromise the machine of anyone who checks out this branch.

Automated scans can be wrong, so this may be a false positive. Maintainers: please review the flagged files carefully before merging, on GitHub in your browser rather than by checking out the branch. The malicious part is often hidden far off to the right of an ordinary-looking line, so scroll sideways through each file.

@cindybby18: this pull request adds or changes these files, possibly without your knowledge. Malware like this spreads by adding itself to repositories on machines it has infected, so your machine might be compromised. Please undo these changes in this pull request, and don't open or run other projects on that machine until you've checked it.

Flagged files at commit 2121a8d:

• .gitignore
• eslint.config.mjs
• init
• package.json

Only merge once you're confident these files are safe.

ℹ️ Posted automatically by Drips Wave. Questions? Contact support@drips.network.