chore: unify monorepo on Bun

Replace pnpm with Bun for apps/ui, apps/docs, root orchestration, CI, and docs so all three apps share one package-manager story.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: agjs

.github/workflows/apps-api-acl-drift.yml

@@ -52,6 +52,6 @@ jobs:
         run: |
           if ! bun run generate:acl-types:check; then
             echo "::error::apps/ui/src/lib/acl/acl.types.generated.ts is stale against this API change."
-            echo "::error::To fix: from repo root run 'pnpm regen' (or 'cd apps/api && bun run generate:acl-types') and commit apps/ui in the same PR."
+            echo "::error::To fix: from repo root run 'bun run regen' (or 'cd apps/api && bun run generate:acl-types') and commit apps/ui in the same PR."
             exit 1
           fi

.github/workflows/apps-api-openapi-drift.yml

@@ -106,28 +106,23 @@ jobs:
           echo "✗ api did not become reachable in 30s" >&2
           exit 1
 
-      - name: Setup pnpm
-        uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
-        with:
-          version: 11.1.2
-
-      - name: Setup Node
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+      - name: Set up Bun
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
         with:
-          node-version-file: apps/ui/.nvmrc
+          bun-version: 1.3.13
 
       - name: Install ui-template deps
         working-directory: apps/ui
-        run: pnpm install --frozen-lockfile
+        run: bun install --frozen-lockfile
 
       - name: Check ui-template schema is up-to-date
         working-directory: apps/ui
         env:
           OPENAPI_URL: http://localhost:3000/swagger/json
         run: |
-          if ! pnpm generate:api:check; then
+          if ! bun run generate:api:check; then
             echo "::error::apps/ui/src/lib/api/schema.d.ts is stale against this API change."
-            echo "::error::To fix: boot api on :3000, then from repo root run 'pnpm regen' and commit apps/ui in the same PR."
+            echo "::error::To fix: boot api on :3000, then from repo root run 'bun run regen' and commit apps/ui in the same PR."
             exit 1
           fi
 

.github/workflows/apps-docs-linkcheck.yml

@@ -13,15 +13,15 @@ on:
       - "apps/docs/scripts/**"
       - "apps/docs/astro.config.mjs"
       - "apps/docs/package.json"
-      - "apps/docs/pnpm-lock.yaml"
+      - "apps/docs/bun.lock"
       - ".github/workflows/apps-docs-linkcheck.yml"
   pull_request:
     paths:
       - "apps/docs/src/**"
       - "apps/docs/scripts/**"
       - "apps/docs/astro.config.mjs"
       - "apps/docs/package.json"
-      - "apps/docs/pnpm-lock.yaml"
+      - "apps/docs/bun.lock"
       - ".github/workflows/apps-docs-linkcheck.yml"
   workflow_dispatch:
 
@@ -41,26 +41,16 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - uses: pnpm/action-setup@v4
-        with:
-          version: 10
-
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 22
-          cache: pnpm
-          cache-dependency-path: apps/docs/pnpm-lock.yaml
-
       - uses: oven-sh/setup-bun@v2
         with:
           bun-version: 1.3.13
 
       - name: Install docs deps
-        run: pnpm install --frozen-lockfile
+        run: bun install --frozen-lockfile
 
       - name: Install ui-template deps for lint-meta export
         working-directory: apps/ui
-        run: pnpm install --frozen-lockfile
+        run: bun install --frozen-lockfile
 
       - name: Install api-template deps for lint-meta export
         working-directory: apps/api
@@ -70,13 +60,13 @@ jobs:
         env:
           BORINGSTACK_UI_DIR: ${{ github.workspace }}/apps/ui
           BORINGSTACK_API_DIR: ${{ github.workspace }}/apps/api
-        run: pnpm check:docs-data
+        run: bun run check:docs-data
 
       - name: Build docs site
         env:
           BORINGSTACK_UI_DIR: ${{ github.workspace }}/apps/ui
           BORINGSTACK_API_DIR: ${{ github.workspace }}/apps/api
-        run: pnpm build:ci
+        run: bun run build:ci
 
       - name: Internal link check (fail on broken)
         uses: lycheeverse/lychee-action@v2

.github/workflows/apps-docs-security-deps.yml

@@ -52,7 +52,7 @@ jobs:
           set +e
           osv-scanner \
             --config=apps/docs/osv-scanner.toml \
-            --lockfile=apps/docs/pnpm-lock.yaml \
+            --lockfile=apps/docs/bun.lock \
             --format=sarif \
             --output-file=osv-results.sarif
           echo "OSV_EXIT=$?" >> "$GITHUB_ENV"
@@ -87,8 +87,8 @@ jobs:
             exit 1
           fi
 
-      # No pnpm audit step here: osv-scanner above with osv-scanner.toml is
-      # the canonical "what we accept" allowlist for this docs repo. pnpm
+      # No bun audit step here: osv-scanner above with osv-scanner.toml is
+      # the canonical "what we accept" allowlist for this docs repo. bun
       # audit can't reference the same allowlist (CVE IDs only, no GHSA
       # support), so it would always reintroduce noise. The docs site is a
       # static-site build with no runtime auth or user input. osv is

.github/workflows/apps-ui-bundle-diff.yml

@@ -6,7 +6,7 @@ on:
     paths:
       - "apps/ui/src/**"
       - "apps/ui/package.json"
-      - "apps/ui/pnpm-lock.yaml"
+      - "apps/ui/bun.lock"
       - "apps/ui/vite.config.ts"
       - "apps/ui/.size-limit.json"
       - ".github/workflows/apps-ui-bundle-diff.yml"
@@ -29,26 +29,22 @@ jobs:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
-      - name: Setup pnpm
-        uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
+      - name: Set up Bun
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
         with:
-          version: 11.1.2
+          bun-version: 1.3.13
 
-      - name: Setup Node
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
-        with:
-          node-version-file: apps/ui/.nvmrc
-          cache: pnpm
-          cache-dependency-path: apps/ui/pnpm-lock.yaml
+      - name: Install
+        run: bun install --frozen-lockfile
 
-      # size-limit-action runs `pnpm install` + `pnpm build` itself on both
-      # the base branch and the head, then diffs. We pass `script` so it
-      # builds with our exact production pipeline (typecheck + vite build).
+      # size-limit-action runs install + build on both branches internally
+      # unless skip_step is set. We pre-install with bun and use npm as the
+      # runner because bun's node_modules layout is npm-compatible.
       - name: Comment with bundle-size diff
         uses: andresz1/size-limit-action@94bc357df29c36c8f8d50ea497c3e225c3c95d1d # v1.8.0
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:
-          package_manager: pnpm
+          package_manager: npm
           script: build
           skip_step: install

.github/workflows/apps-ui-release.yml

@@ -44,20 +44,13 @@ jobs:
         with:
           fetch-depth: 0
 
-      - name: Setup pnpm
-        uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
+      - name: Set up Bun
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
         with:
-          version: 11.1.2
-
-      - name: Setup Node
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
-        with:
-          node-version-file: apps/ui/.nvmrc
-          cache: pnpm
-          cache-dependency-path: apps/ui/pnpm-lock.yaml
+          bun-version: 1.3.13
 
       - name: Install
-        run: pnpm install --frozen-lockfile
+        run: bun install --frozen-lockfile
 
       # Opens or updates a "Version Packages" PR when changesets exist on main.
       # On merge of that PR, this same step pushes the version bump + tag and
@@ -67,8 +60,8 @@ jobs:
         id: changesets
         uses: changesets/action@63a615b9cd06ba9a3e6d13796c7fbcb080a60a0b # v1.8.0
         with:
-          version: pnpm exec changeset version
-          publish: pnpm exec changeset tag
+          version: bunx changeset version
+          publish: bunx changeset tag
           createGithubReleases: true
           commit: "chore: version packages"
           title: "chore: version packages"

.github/workflows/apps-ui-security-deps.yml

@@ -52,7 +52,7 @@ jobs:
           set +e
           osv-scanner \
             --config=apps/ui/osv-scanner.toml \
-            --lockfile=apps/ui/pnpm-lock.yaml \
+            --lockfile=apps/ui/bun.lock \
             --format=sarif \
             --output-file=osv-results.sarif
           echo "OSV_EXIT=$?" >> "$GITHUB_ENV"
@@ -73,8 +73,10 @@ jobs:
             exit 1
           fi
 
-      - name: Set up pnpm
-        uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
+      - name: Set up Bun
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
+        with:
+          bun-version: 1.3.13
 
-      - name: pnpm audit
-        run: pnpm audit --audit-level high
+      - name: bun audit
+        run: bun audit --audit-level high

.github/workflows/apps-ui-validate.yml

@@ -27,44 +27,37 @@ jobs:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
-      - name: Setup pnpm
-        uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
+      - name: Set up Bun
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
         with:
-          version: 11.1.2
-
-      - name: Setup Node
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
-        with:
-          node-version-file: apps/ui/.nvmrc
-          cache: pnpm
-          cache-dependency-path: apps/ui/pnpm-lock.yaml
+          bun-version: 1.3.13
 
       - name: Install
-        run: pnpm install --frozen-lockfile
+        run: bun install --frozen-lockfile
 
       - name: Dependency audit
-        run: pnpm audit --audit-level high
+        run: bun audit --audit-level high
 
       - name: Lint + format + typecheck
-        run: pnpm check
+        run: bun run check
 
       - name: Unit + integration tests
-        run: pnpm test:ci
+        run: bun run test:ci
 
       - name: Build
-        run: pnpm build
+        run: bun run build
 
       - name: Bundle size budget
-        run: pnpm size:check
+        run: bun run size:check
 
       - name: Modulepreload size coverage
-        run: pnpm size:check:modulepreload
+        run: bun run size:check:modulepreload
 
       - name: Lighthouse CI (a11y + best-practices + SEO + perf budgets)
-        run: pnpm exec lhci autorun
+        run: bunx lhci autorun
 
       - name: Build Storybook
-        run: pnpm build-storybook
+        run: bun run build-storybook
 
       - name: Upload dist
         if: always()

.github/workflows/infra-compose-full-stack-smoke.yml

@@ -134,19 +134,10 @@ jobs:
             exit 1
           }
 
-      # pnpm 11 requires Node >= 22.13. The runner default is older, so install
-      # both via the maintained actions instead of `npm install -g pnpm`.
-      - name: Setup pnpm
-        uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
+      - name: Set up Bun
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
         with:
-          version: 11.1.2
-
-      - name: Setup Node
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
-        with:
-          node-version-file: apps/ui/.nvmrc
-          cache: pnpm
-          cache-dependency-path: apps/ui/pnpm-lock.yaml
+          bun-version: 1.3.13
 
       - name: Check UI OpenAPI schema is up to date
         working-directory: apps/ui
@@ -155,16 +146,16 @@ jobs:
           # apps/ui node_modules from the container, so the host runner can't recreate it.
           # Drop root-owned bits before installing as the runner user.
           sudo rm -rf node_modules
-          pnpm install --frozen-lockfile
-          pnpm generate:api:check
+          bun install --frozen-lockfile
+          bun run generate:api:check
 
       - name: Run UI Playwright E2E
         working-directory: apps/ui
         env:
           PLAYWRIGHT_REUSE_SERVER: "true"
         run: |
-          pnpm e2e:install
-          pnpm e2e:ci
+          bun run e2e:install
+          bun run e2e:ci
 
       - name: Smoke — register a brand-new user
         run: |

.gitignore

@@ -13,3 +13,4 @@ coverage/
 .dev.vars*
 !.dev.vars.example
 .pnpm-store/
+.bun-install/