Make Bun workflows idiomatic for Mill and Scala.js

.github/workflows/ci.yml

@@ -3,14 +3,18 @@ on:
   push:
     branches: [main]
   pull_request:
-    branches: [main]
 
 jobs:
   build:
     strategy:
+      fail-fast: false
       matrix:
-        os: [ubuntu-latest, macos-latest]
+        os: [ubuntu-latest, macos-latest, windows-latest]
     runs-on: ${{ matrix.os }}
+    defaults:
+      run:
+        # One wrapper invocation everywhere: git-bash on the Windows runner runs ./mill too.
+        shell: bash
     steps:
       - uses: actions/checkout@v4
 
@@ -19,15 +23,98 @@ jobs:
           distribution: temurin
           java-version: '21'
 
+      - uses: actions/cache@v4
+        with:
+          path: ~/.cache/mill-bun
+          key: mill-bun-${{ runner.os }}-${{ hashFiles('millbun/src/mill/bun/BunToolchainModule.scala') }}
+
+      - name: Select Mill launcher
+        # The sh wrapper fetches Mill's native launcher, which has no Windows build
+        # ("This native mill launcher supports only Linux and macOS") — Windows goes
+        # through the committed mill.bat instead.
+        run: echo "MILL=./mill$([ "$RUNNER_OS" = "Windows" ] && echo .bat)" >> "$GITHUB_ENV"
+
       - uses: oven-sh/setup-bun@v2
         with:
-          bun-version: latest
+          bun-version: 1.4.0
 
       - name: Compile
-        run: ./mill millbun.compile
+        run: $MILL --no-server millbun.compile
 
       - name: Unit Tests
-        run: ./mill millbun.test
+        run: $MILL --no-server millbun.test
 
+      # The suite defaults to the managed toolchain; this job pins system Bun to the same
+      # version so `findOnPath` resolution and version verification keep CI coverage, while
+      # the managed-bun job covers the download/cache path.
       - name: Integration Tests
-        run: ./mill millbun.integration
+        env:
+          MILL_BUN_USE_SYSTEM: 'true'
+        run: $MILL --no-server millbun.integration
+
+  managed-bun:
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest]
+    runs-on: ${{ matrix.os }}
+    defaults:
+      run:
+        shell: bash
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: '21'
+
+      - uses: actions/cache@v4
+        with:
+          path: ~/.cache/mill-bun
+          key: mill-bun-${{ runner.os }}-${{ hashFiles('millbun/src/mill/bun/BunToolchainModule.scala') }}
+
+      - name: Select Mill launcher
+        # The sh wrapper fetches Mill's native launcher, which has no Windows build
+        # ("This native mill launcher supports only Linux and macOS") — Windows goes
+        # through the committed mill.bat instead.
+        run: echo "MILL=./mill$([ "$RUNNER_OS" = "Windows" ] && echo .bat)" >> "$GITHUB_ENV"
+
+      - name: Managed Bun smoke test
+        env:
+          MILL_BUN_USE_SYSTEM: 'false'
+        run: $MILL --no-server millbun.integration.testOnly mill.bun.BunManagedToolchainIntegrationTests
+
+  examples:
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        shell: bash
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: '21'
+
+      - uses: actions/cache@v4
+        with:
+          path: ~/.cache/mill-bun
+          key: mill-bun-${{ runner.os }}-${{ hashFiles('millbun/src/mill/bun/BunToolchainModule.scala') }}
+
+      # Publish at whatever version the examples pin, so a release-version sweep cannot
+      # silently desynchronize this leg.
+      - name: Publish the plugin locally
+        run: |
+          V=$(grep -o 'mill-bun_mill1:[0-9][-0-9A-Za-z.]*' example-typescript/build.mill | cut -d: -f2)
+          PUBLISH_VERSION=$V ./mill --no-server millbun.publishLocal
+
+      - name: example-typescript
+        run: cd example-typescript && ./mill --no-server app.run && ./mill --no-server app.test.testForked
+
+      - name: example-scalajs
+        run: cd example-scalajs && ./mill --no-server app.run && ./mill --no-server app.test.testForked
+
+      - name: examples project compiles
+        run: cd examples && ./mill --no-server __.compile

.github/workflows/release.yml

@@ -31,7 +31,7 @@ jobs:
       - name: Set up Bun
         uses: oven-sh/setup-bun@v2
         with:
-          bun-version: latest
+          bun-version: 1.4.0
 
       - name: Cache Coursier
         uses: actions/cache@v4
@@ -91,6 +91,8 @@ jobs:
         run: ./mill --no-server millbun.test
 
       - name: Integration tests
+        env:
+          MILL_BUN_USE_SYSTEM: "true"
         run: ./mill --no-server millbun.integration
 
       - name: Reset cached publish metadata

.gitignore

@@ -8,5 +8,4 @@ out/
 *.tasty
 node_modules/
 .DS_Store
-.mill-jvm-version
 .claude/plans/

CHANGELOG.md

@@ -5,12 +5,46 @@ All notable changes to `mill-bun-plugin` will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-## [Unreleased]
+## [0.3.0] - Managed toolchain, strict lockfiles, canonical vocabulary (2026-08-27)
 
 ### Added
 
 - Tag-driven release workflow for Maven Central publishing and GitHub releases.
 - Release runbook covering secrets, version sweep, annotated tags, and verification.
+- Checksum-verified managed Bun 1.4.0 for macOS, Linux, and Windows on x64 and arm64, including
+  musl (auto-detected) and `-baseline` (via `bunUseBaseline`) builds.
+- `bunArchiveSha256` may be set on its own to run a Bun version with no bundled checksum; the
+  download URL is derived from `bunVersion` and the detected platform.
+- Strict text-lockfile workflow with `bunLock`, frozen installs, and actionable missing-lock failures.
+- Canonical `bundle`, `bundleFast`, `compileExecutable`, and `compileExecutables` task names.
+- Paired `BunScalaJSWebModule` and `BunTypeScriptWebModule` HTML workflows.
+- `npmOptionalDeps`, `npmPeerDeps`, `npmOverrides`, and deterministic dependency conflict detection.
+- `BunWorkspaceModule` for one install and lockfile across mixed Scala.js/TypeScript packages.
+- Published dependency manifest schema v2 with runtime, optional, and peer requirements.
+- `bunDoctor` diagnostics and managed-toolchain CI smoke coverage.
+- A committed lockfile written by a newer Bun fails frozen installs with regeneration guidance,
+  instead of surfacing bun's raw `UnknownLockfileVersion`.
+
+### Changed
+
+- Scala.js linking delegates to Mill's standard linker hooks; applications now choose `scalaJSVersion` explicitly.
+- Development dependencies are local tooling inputs and are no longer published transitively.
+- `bunPackageJsonExtras` rejects dependency fields now represented by typed settings.
+- Missing dependency versions are represented as `latest` instead of an empty package.json value.
+- TypeScript `bunBundleFormat` is `Option[String]`, matching Scala.js; `None` lets `bun build` infer.
+- `unmanagedDeps` entries are staged into `vendor/` and declared as `file:./vendor/<name>`
+  dependencies, so local packages install under frozen lockfiles and locks stay portable.
+- The TypeScript install task is canonically `bunInstall`; Mill's inherited `npmInstall` delegates to it.
+- `bunToolEnv` is defined once on `BunToolchainModule` for all toolchain subprocesses, and the
+  TypeScript `bunRuntimeEnv` is public.
+
+### Deprecated
+
+- Scala.js `bunBundle*` and `bunCompile*` task names in favor of their canonical aliases.
+- `bunOptionalDeps` in favor of `npmOptionalDeps`.
+- `managedBunExecutable` in favor of `bunExecutableOverride`.
+- The TypeScript `bunCompileExecutable: Boolean` switch in favor of the `compileExecutable` task.
+- The TypeScript test command `test` and the Scala.js test command `bunTest`, both in favor of `testForked`.
 
 ## [0.2.1] - Overridable test-time JS env (2026-04-17)
 
@@ -40,4 +74,3 @@ object test extends BunScalaJSTests:
     super.bunTestJsEnv() + ("NODE_ENV" -> "production")
   }
 ```
-