fix(ci): verify Bun release without setup action

Author: hyperpolymath

.github/workflows/ci.yml

@@ -57,13 +57,23 @@ jobs:
         with:
           node-version: "20"
       - name: Set up Bun
-        # v2.2.0 moved the action runtime to node24, which caused a workflow
-        # startup_failure before any job was instantiated on this runner path.
-        # Keep the setup action on its Node-20-compatible release until the
-        # runner accepts Node-24 actions; pin the installed Bun independently.
-        uses: oven-sh/setup-bun@735343b667d3e6f658f44d0eca948eb6282f2b76 # v2.0.2
-        with:
-          bun-version: "1.3.14"
+        # The repository's selected-action path rejects setup-bun before job
+        # instantiation (a zero-job startup_failure). Fetch the immutable Bun
+        # release asset directly and verify the digest published by GitHub's
+        # release API instead. The runtime never enters $HOME.
+        env:
+          BUN_VERSION: "1.3.14"
+          BUN_LINUX_X64_SHA256: "951ee2aee855f08595aeec6225226a298d3fea83a3dcd6465c09cbccdf7e848f"
+        run: |
+          archive="$RUNNER_TEMP/bun-linux-x64.zip"
+          install_dir="$RUNNER_TEMP/bun-runtime"
+          curl --fail --location --retry 3 \
+            --output "$archive" \
+            "https://github.com/oven-sh/bun/releases/download/bun-v${BUN_VERSION}/bun-linux-x64.zip"
+          printf '%s  %s\n' "$BUN_LINUX_X64_SHA256" "$archive" | sha256sum --check --strict
+          unzip -q "$archive" -d "$install_dir"
+          printf '%s\n' "$install_dir/bun-linux-x64" >> "$GITHUB_PATH"
+          "$install_dir/bun-linux-x64/bun" --version
       - name: Install dependencies
         run: opam install . --deps-only --with-test --with-doc --yes
       - name: Install tree-sitter CLI (for res-to-affine walker tests)