we are using BUN now!! also general QoL updates - #180
Conversation
📝 WalkthroughWalkthroughThe project migrates package management, CI type checking, Docker builds, Prisma generation, and application startup from pnpm and Node.js to Bun. The README updates tooling information and contribution guidance. ChangesBun Toolchain Migration
Estimated code review effort: 3 (Moderate) | ~20 minutes Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Warning There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure. 🔧 ESLint
ESLint install failed. For unrecoverable errors, disable the tool in CodeRabbit configuration. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🧹 Nitpick comments (1)
Dockerfile (1)
1-1: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick winPin the Bun base image to an exact release.
oven/bun:1is a mutable Docker image tag. Replace it with a tested exact release, such asoven/bun:1.3.14-alpine, or pin the image digest so rebuilds cannot select a different Bun or OS image whilebun.lockremains unchanged.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@Dockerfile` at line 1, Update the Dockerfile builder stage’s FROM declaration to use a tested exact Bun release, such as oven/bun:1.3.14-alpine, or an immutable image digest instead of the mutable oven/bun:1 tag. Keep the selected Bun and OS image aligned with the project’s bun.lock expectations.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/typeCheck.yml:
- Around line 17-18: Update the actions/checkout@v5 step in the workflow to set
persist-credentials to false, leaving the existing checkout behavior unchanged.
In `@Dockerfile`:
- Around line 25-27: Update the Dockerfile runtime setup around the final CMD to
run as USER bun instead of root. Ensure the application files and required
.next/cache paths are owned or writable by bun before switching users, then
preserve the existing bun start command.
In `@README.md`:
- Around line 236-242: Update the CONTRIBUTING.md file to reflect Bun as the
primary package manager and build tool instead of Node.js and npm/pnpm. Replace
the setup and installation instructions that reference npm or pnpm commands with
their Bun equivalents, and remove or update any references to the older npm/npx
workflow. Ensure the documented development workflow in CONTRIBUTING.md is
consistent with the statement in README.md that Bun is the package manager and
build tool.
---
Nitpick comments:
In `@Dockerfile`:
- Line 1: Update the Dockerfile builder stage’s FROM declaration to use a tested
exact Bun release, such as oven/bun:1.3.14-alpine, or an immutable image digest
instead of the mutable oven/bun:1 tag. Keep the selected Bun and OS image
aligned with the project’s bun.lock expectations.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 5929dc4f-5cee-4f44-ad32-6951466184d1
⛔ Files ignored due to path filters (3)
bun.lockis excluded by!**/*.lockpackage-lock.jsonis excluded by!**/package-lock.jsonpnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (6)
.github/workflows/typeCheck.yml.vscode/settings.jsonDockerfileREADME.mdpackage.jsonpnpm-workspace.yaml
💤 Files with no reviewable changes (2)
- .vscode/settings.json
- pnpm-workspace.yaml
| - name: Checkout code | ||
| uses: actions/checkout@v5 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Set persist-credentials: false on checkout.
actions/checkout@v5 persists the GITHUB_TOKEN in the local git config by default. This job then runs bun install --frozen-lockfile and bunx prisma generate, both of which can execute third-party package code. If a dependency's install script or lifecycle hook is compromised, it can read the persisted token from the checked-out git config. Disable credential persistence since this job does not need to push or authenticate back to GitHub.
🔒 Proposed fix
- name: Checkout code
uses: actions/checkout@v5
+ with:
+ persist-credentials: false📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - name: Checkout code | |
| uses: actions/checkout@v5 | |
| - name: Checkout code | |
| uses: actions/checkout@v5 | |
| with: | |
| persist-credentials: false |
🧰 Tools
🪛 zizmor (1.28.0)
[warning] 17-18: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/typeCheck.yml around lines 17 - 18, Update the
actions/checkout@v5 step in the workflow to set persist-credentials to false,
leaving the existing checkout behavior unchanged.
Source: Linters/SAST tools
| EXPOSE 3000 | ||
|
|
||
| # Start the app | ||
| CMD ["pnpm", "run", "start"] | ||
| CMD ["bun", "run", "start"] |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/sh
set -eu
docker run --rm --entrypoint sh oven/bun:1 -c 'id; id bun'Repository: PlanetaryOrbit/orbit
Length of output: 202
🏁 Script executed:
#!/bin/sh
set -eu
printf 'Dockerfile contents:\n'
if [ -f Dockerfile ]; then
cat -n Dockerfile
else
printf 'Dockerfile not found\n'
fi
printf '\nTrivy/config references to USER or root:\n'
git ls-files | rg '(^|/)(Dockerfile|.*\.ya?ml|.*\.json|.*\.md)$' | while read -r f; do
if rg -n 'USER|ROOT|trivy|root' "$f" >/dev/null 2>&1; then
printf '\n--- %s ---\n' "$f"
rg -n 'USER|ROOT|trivy|root' "$f" || true
fi
done
printf '\nPackage next/bun references:\n'
for f in package.json bun.lockb bun.lock pnpm-lock.yaml yarn.lock package-lock.json; do
if [ -f "$f" ]; then
echo "--- $f ---"
rg -n '"next"|"`@next`|bun|next' "$f" || true
fi
doneRepository: PlanetaryOrbit/orbit
Length of output: 9335
🌐 Web query:
oven/bun Dockerfile USER bun uid gid
💡 Result:
In the official oven/bun Docker images, a user named bun is pre-configured with UID 1000 and GID 1000 [1][2][3]. When writing a Dockerfile for your Bun application, you can leverage this pre-existing user to run your container as a non-root user, which is a recommended security best practice [4][5]. Key points regarding the bun user: - Creation: The user is automatically created during the build of the official oven/bun images with UID 1000 and GID 1000 [1][3]. - Usage: To switch to this user, simply add USER bun to your Dockerfile, typically after you have finished installing dependencies and setting up your application files [6][7][5]. - Permissions: A common pitfall when switching to the bun user is encountering permission errors if you attempt to write to directories (e.g., creating folders or installing files) that are owned by root [8]. To avoid this, ensure you set the correct ownership of your application directory before switching the user, for example by using the --chown flag with the COPY instruction or by running a chown command while still operating as root [9][5][8]. Example of proper implementation: # Use the official Bun image FROM oven/bun:1 AS base WORKDIR /usr/src/app # Install dependencies as root (or ensure ownership is set) COPY package.json bun.lock./ RUN bun install --frozen-lockfile --production # Copy application code with correct ownership COPY --chown=bun:bun.. # Switch to the non-root user USER bun # Run the application ENTRYPOINT [ "bun", "run", "index.ts" ] Using this approach ensures your application maintains the security benefits of running as a non-privileged user while avoiding common filesystem permission issues [10][5][11].
Citations:
- 1: https://github.com/oven-sh/bun/blob/main/dockerhub/debian/Dockerfile
- 2: https://github.com/oven-sh/bun/blob/7e57e529/dockerhub/debian-slim/Dockerfile
- 3: https://github.com/oven-sh/bun/blob/74e191b3/dockerhub/alpine/Dockerfile
- 4: https://blog.openreplay.com/dockerize-bun-application/
- 5: https://playbooks.com/skills/secondsky/claude-skills/bun-docker
- 6: https://oven-sh-bun.mintlify.app/guides/docker
- 7: https://bun.sh/docs/guides/ecosystem/docker
- 8: Docker:
bunuser doesn't have write permission for/home/bun/appdue toWORKDIRissue oven-sh/bun#14185 - 9: https://oneuptime.com/blog/post/2026-02-08-how-to-containerize-an-elysia-bun-application-with-docker/view
- 10: https://engineering.oakoliver.com/articles/docker-multistage-builds-for-bun
- 11: https://hub.docker.com/hardened-images/catalog/dhi/bun/guides
Run the final container as a non-root user.
Dockerfile sets CMD ["bun", "run", "start"] without a USER, so the Next.js runtime inherits the default user from oven/bun:1. Add USER bun after setting application ownership, and grant the runtime user write access to .next/cache paths that must be updated in running containers.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@Dockerfile` around lines 25 - 27, Update the Dockerfile runtime setup around
the final CMD to run as USER bun instead of root. Ensure the application files
and required .next/cache paths are owned or writable by bun before switching
users, then preserve the existing bun start command.
Source: Linters/SAST tools
| - **Bun** is used as the package manager and build tool. | ||
|
|
||
| --- | ||
|
|
||
| ## Contributing | ||
|
|
||
| Contributions are welcome and appreciated. Whether you're fixing a bug, improving documentation, or proposing a new feature, here's how to get involved: | ||
|
|
||
| 1. **Fork** the repository and create a new branch from `main`. | ||
| 2. **Make your changes**, following the existing code style. | ||
| 3. **Test** your changes locally before submitting. | ||
| 4. **Open a Pull Request** with a clear description of what you've changed and why. | ||
|
|
||
| For bug reports and feature requests, please use our [feedback portal](https://feedback.planetaryapp.us/bugs). For questions and discussion, join our [Discord server](https://discord.com/invite/mWqdZmEkDc). | ||
| View the [contribution guidelines](./CONTRIBUTING.md) for more information on how to contribute to Orbit. |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Update CONTRIBUTING.md to match the Bun workflow.
The README identifies Bun as the package manager and build tool, but CONTRIBUTING.md still lists Node.js and npm/pnpm at Lines 39-82 and uses the older npm/npx workflow. Update CONTRIBUTING.md in this PR, or document the supported alternatives consistently.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@README.md` around lines 236 - 242, Update the CONTRIBUTING.md file to reflect
Bun as the primary package manager and build tool instead of Node.js and
npm/pnpm. Replace the setup and installation instructions that reference npm or
pnpm commands with their Bun equivalents, and remove or update any references to
the older npm/npx workflow. Ensure the documented development workflow in
CONTRIBUTING.md is consistent with the statement in README.md that Bun is the
package manager and build tool.
1 participant
Summary by CodeRabbit
Chores
Documentation
Maintenance