feat: convert toolchain to Bun and ship standalone binaries

.github/workflows/ci.yml

@@ -6,31 +6,73 @@ on:
   pull_request:
 
 jobs:
-  ci:
-    name: Node ${{ matrix.node }}
+  test:
     runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        node: [22, 24]
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
+        with:
+          bun-version: 1.3.14
+
+      # Node is still a supported runtime and npm pack is part of the release
+      # contract. Pin both rather than relying on the runner image defaults.
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version: ${{ matrix.node }}
-          cache: npm
+          node-version: 22
 
       - name: Install
-        run: npm ci
+        run: bun install --frozen-lockfile
 
       - name: Typecheck
-        run: npm run typecheck
+        run: bun run typecheck
 
       - name: Build
-        run: npm run build
+        run: bun run build
 
       - name: Test
-        run: npm test
+        run: bun test
+
+      - name: Verify packed npm package
+        run: node scripts/check-package.mjs
+
+      - name: Binary smoke test
+        run: scripts/smoke-binary.sh
+
+      - name: Cross-compile all release targets
+        run: |
+          scripts/build-binaries.sh v0.0.0-ci
+          test "$(wc -l < dist/binaries/checksums.txt | tr -d ' ')" -eq 8
+          (cd dist/binaries && shasum -a 256 -c checksums.txt)
+
+      - name: Validate generated Homebrew formula
+        run: |
+          scripts/update-homebrew-formula.sh v0.0.0 dist/binaries/checksums.txt /tmp/workos-emulate.rb
+          ruby -c /tmp/workos-emulate.rb
+
+  node-smoke:
+    name: Node ${{ matrix.node }} compatibility
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        node: [22, 24]
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
+        with:
+          bun-version: 1.3.14
+
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: ${{ matrix.node }}
+
+      - name: Install
+        run: bun install --frozen-lockfile
+
+      - name: Build
+        run: bun run build
 
-      - name: Pack
-        run: npm pack --dry-run
+      - name: Node library compatibility suite
+        run: node scripts/smoke-node.mjs

.github/workflows/lint-pr-title.yml

@@ -8,7 +8,7 @@ permissions:
   pull-requests: read
 
 jobs:
-  lint:
+  lint-pr-title:
     runs-on: ubuntu-latest
     steps:
       - uses: amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50 # v6.1.1

.github/workflows/lint.yml

@@ -11,16 +11,15 @@ jobs:
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
         with:
-          node-version: 24
-          cache: npm
+          bun-version: 1.3.14
 
       - name: Install
-        run: npm ci
+        run: bun install --frozen-lockfile
 
       - name: Lint
-        run: npm run lint
+        run: bun run lint
 
       - name: Format check
-        run: npm run fmt:check
+        run: bun run fmt:check

.github/workflows/release-please.yml

@@ -28,3 +28,6 @@ jobs:
     uses: ./.github/workflows/release.yml
     with:
       tag_name: ${{ needs.release-please.outputs.tag_name }}
+    # The Homebrew job needs the SDK bot credentials. Passing all repository
+    # secrets also keeps workflow_dispatch retries equivalent to called runs.
+    secrets: inherit