refactor(ci): inline bun setup, gate cache on snapshot

.github/workflows/ci.yml

@@ -31,7 +31,12 @@ jobs:
         with:
           ref: ${{ inputs.ref }}
       - uses: oven-sh/setup-bun@v2
-      - uses: actions/cache@v5
+      # Skip cache restore when invoked via workflow_call from release.yml's
+      # snapshot path (issue_comment trigger). That path checks out
+      # PR-author-controlled code in the default branch's privileged context;
+      # consuming a cached install in that context is a poisoning surface.
+      - if: github.event_name != 'issue_comment'
+        uses: actions/cache/restore@v5
         with:
           path: ~/.bun/install/cache
           key: bun-${{ runner.os }}-${{ hashFiles('bun.lock') }}
@@ -49,7 +54,8 @@ jobs:
         with:
           ref: ${{ inputs.ref }}
       - uses: oven-sh/setup-bun@v2
-      - uses: actions/cache/restore@v5
+      - if: github.event_name != 'issue_comment'
+        uses: actions/cache/restore@v5
         with:
           path: ~/.bun/install/cache
           key: bun-${{ runner.os }}-${{ hashFiles('bun.lock') }}
@@ -69,7 +75,8 @@ jobs:
         with:
           ref: ${{ inputs.ref }}
       - uses: oven-sh/setup-bun@v2
-      - uses: actions/cache/restore@v5
+      - if: github.event_name != 'issue_comment'
+        uses: actions/cache/restore@v5
         with:
           path: ~/.bun/install/cache
           key: bun-${{ runner.os }}-${{ hashFiles('bun.lock') }}
@@ -114,7 +121,8 @@ jobs:
       - name: Mark workspace as safe for git
         run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
       - uses: oven-sh/setup-bun@v2
-      - uses: actions/cache/restore@v5
+      - if: github.event_name != 'issue_comment'
+        uses: actions/cache/restore@v5
         with:
           path: ~/.bun/install/cache
           key: bun-${{ runner.os }}-${{ hashFiles('bun.lock') }}

.github/workflows/notify-failure.yml

@@ -20,7 +20,13 @@ jobs:
     timeout-minutes: 5
     steps:
       - uses: actions/checkout@v6
-      - uses: ./.github/actions/setup-bun
+      - uses: oven-sh/setup-bun@v2
+      - uses: actions/cache/restore@v5
+        with:
+          path: ~/.bun/install/cache
+          key: bun-${{ runner.os }}-${{ hashFiles('bun.lock') }}
+          restore-keys: bun-${{ runner.os }}-
+      - run: bun install --frozen-lockfile
       - name: Notify Slack
         run: bun scripts/slack.ts --status failure
         env:

.github/workflows/notify-release.yml

@@ -20,7 +20,13 @@ jobs:
     timeout-minutes: 5
     steps:
       - uses: actions/checkout@v6
-      - uses: ./.github/actions/setup-bun
+      - uses: oven-sh/setup-bun@v2
+      - uses: actions/cache/restore@v5
+        with:
+          path: ~/.bun/install/cache
+          key: bun-${{ runner.os }}-${{ hashFiles('bun.lock') }}
+          restore-keys: bun-${{ runner.os }}-
+      - run: bun install --frozen-lockfile
       - name: Notify Slack
         run: bun scripts/slack-release.ts --version "$VERSION"
         env:

.github/workflows/release.yml

@@ -36,9 +36,13 @@ jobs:
       version: ${{ steps.check.outputs.version }}
     steps:
       - uses: actions/checkout@v6
-      - uses: ./.github/actions/setup-bun
+      - uses: oven-sh/setup-bun@v2
+      - uses: actions/cache/restore@v5
         with:
-          cache: restore
+          path: ~/.bun/install/cache
+          key: bun-${{ runner.os }}-${{ hashFiles('bun.lock') }}
+          restore-keys: bun-${{ runner.os }}-
+      - run: bun install --frozen-lockfile
 
       - name: Check if release needed
         id: check
@@ -194,9 +198,13 @@ jobs:
       version: ${{ steps.version.outputs.version }}
     steps:
       - uses: actions/checkout@v6
-      - uses: ./.github/actions/setup-bun
+      - uses: oven-sh/setup-bun@v2
+      - uses: actions/cache/restore@v5
         with:
-          cache: restore
+          path: ~/.bun/install/cache
+          key: bun-${{ runner.os }}-${{ hashFiles('bun.lock') }}
+          restore-keys: bun-${{ runner.os }}-
+      - run: bun install --frozen-lockfile
 
       - name: Version packages for canary
         id: version

.github/workflows/warm-bun-cache.yml

@@ -0,0 +1,33 @@
+name: Warm Bun cache
+
+# Populates ~/.bun/install/cache for PR and release runs to read.
+# Runs only on push to main so untrusted (PR/snapshot) code never reaches
+# the cache save action.
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - bun.lock
+      - .github/workflows/warm-bun-cache.yml
+
+permissions:
+  contents: read
+
+concurrency:
+  group: warm-bun-cache-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  warm:
+    runs-on: blacksmith-2vcpu-ubuntu-2404
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v6
+      - uses: oven-sh/setup-bun@v2
+      - uses: actions/cache@v5
+        with:
+          path: ~/.bun/install/cache
+          key: bun-${{ runner.os }}-${{ hashFiles('bun.lock') }}
+          restore-keys: bun-${{ runner.os }}-
+      - run: bun install --frozen-lockfile