chore: bump oven-sh/setup-bun to v2.2.0 (Node.js 24)#1238
Conversation
setup-bun v2.1.2 runs on Node.js 20, which GitHub will stop supporting on June 2, 2026. v2.2.0 updates the action runtime to Node.js 24. Fixes #1237
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
LGTM — verified the SHA matches oven-sh/setup-bun refs/tags/v2.2.0 and v2.
Extended reasoning...
Overview
This PR bumps the pinned commit SHA for the oven-sh/setup-bun action from v2.1.2 (3d26778) to v2.2.0 (0c5077e) in both action.yml and base-action/action.yml. The bun-version: 1.3.6 input is unchanged, so the actual Bun runtime used by the action stays the same — only the Node.js runtime that executes the setup-bun installer moves from Node 20 to Node 24, addressing the upcoming GitHub-hosted runner deprecation.
Security risks
The primary supply-chain concern for a third-party action bump is whether the new SHA actually points to the claimed release. I independently verified via git ls-remote that 0c5077e51419868618aeaa5fe8019c62421857d6 is the exact commit for both refs/tags/v2.2.0 and the floating refs/tags/v2 on oven-sh/setup-bun. The pin is by full SHA (not tag), so it's immutable. No new inputs, permissions, or env vars are introduced.
Level of scrutiny
Low. This is a two-line mechanical version bump of a well-known action, pinned by SHA, with no logic changes. The diff is identical in both files and follows the existing pattern (SHA pin + release URL comment).
Other factors
No bugs were flagged by the bug hunter, no CODEOWNERS file exists for these paths, and there are no outstanding reviewer comments on the timeline. The PR description's verification steps (SHA match, using: node24) align with what I confirmed.
2 participants
Summary
oven-sh/setup-bunpin from v2.1.2 → v2.2.0 (0c5077e) in bothaction.ymlandbase-action/action.ymlusing: "node24"; v2.1.2 uses Node.js 20, which GitHub-hosted runners will force-migrate on June 2, 2026bun-version: 1.3.6is unchanged — only the installer action's Node runtime is affectedFixes #1237
Test plan
bun run format:checkpassesrefs/tags/v2.2.0and currentrefs/tags/v2action.ymldeclaresusing: "node24"