chore(deps): bump oven-sh/setup-bun from 2.0.2 to 2.2.0

[dependabot]

Bumps oven-sh/setup-bun from 2.0.2 to 2.2.0.

Release notes

Sourced from oven-sh/setup-bun's releases.

v2.2.0

oven-sh/setup-bun is the github action for setting up Bun.

What's Changed

• build: update action runtime to Node.js 24 by @​adam0white in oven-sh/setup-bun#176
• ci: use actions/checkout@v6.0.2 in the test workflow by @​tcely in oven-sh/setup-bun#173
• ci: update actions for the autofix.ci workflow by @​tcely in oven-sh/setup-bun#174
• ci: update actions for the Release new action version workflow by @​tcely in oven-sh/setup-bun#175
• release: v2.2.0 by @​xhyrom in oven-sh/setup-bun#177

New Contributors

• @​adam0white made their first contribution in oven-sh/setup-bun#176
• @​tcely made their first contribution in oven-sh/setup-bun#173

Full Changelog: oven-sh/setup-bun@v2...v2.2.0

v2.1.3

oven-sh/setup-bun is the github action for setting up Bun.

What's Changed

• perf: avoid unnecessary api calls by @​xhyrom in oven-sh/setup-bun#161
• feat: add bun- prefix to cache keys by @​maschwenk in oven-sh/setup-bun#160
• fix: use native Windows ARM64 binary for Bun >= 1.3.10 by @​oddrationale in oven-sh/setup-bun#165
• feat: add AVX2 support detection for x64 Linux systems by @​GoForceX in oven-sh/setup-bun#167
• fix: validate cached binary version matches requested version (#146) by @​wyMinLwin in oven-sh/setup-bun#169
• release: v2.1.3 by @​xhyrom in oven-sh/setup-bun#170

New Contributors

• @​oddrationale made their first contribution in oven-sh/setup-bun#165
• @​GoForceX made their first contribution in oven-sh/setup-bun#167
• @​wyMinLwin made their first contribution in oven-sh/setup-bun#169

Full Changelog: oven-sh/setup-bun@v2...v2.1.3

v2.1.2

oven-sh/setup-bun is the github action for setting up Bun.

What's Changed

• fix: default token only on public github instance by @​xhyrom in oven-sh/setup-bun#157

Full Changelog: oven-sh/setup-bun@v2...v2.1.2

v2.1.1

oven-sh/setup-bun is the github action for setting up Bun.

What's Changed

• feat: implement wildcard resolution into the action by @​xhyrom in oven-sh/setup-bun#93
• feat: fallback arm64 to x64 architecture for win32 platform by @​xhyrom in oven-sh/setup-bun#131
• feat: use packageManager from package.json as default bun version by @​xhyrom in oven-sh/setup-bun#152

... (truncated)

Commits

• 0c5077e release: v2.2.0 (#177)
• 1255e43 ci: update actions for the Release new action version workflow (#175)
• 61861d1 ci: update actions for the autofix.ci workflow (#174)
• 6f5bd06 ci: use actions/checkout@v6.0.2 in the test workflow (#173)
• e391475 build: update action runtime to Node.js 24 (#176)
• ecf28dd release: v2.1.3 (#170)
• 95edc15 fix: validate cached binary version matches requested version (#146) (#169)
• 4c32875 feat: add AVX2 support detection for x64 Linux systems (#167)
• 0ff83bf fix: use native Windows ARM64 binary for Bun >= 1.3.10 (#165)
• ab8cb4e feat: add bun- prefix to cache keys (#160)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[tps-kern]

Architecture Review — APPROVE ✅

Minor bump: oven-sh/setup-bun 2.0.2 → 2.2.0. 3 pin changes in ci.yml (build, test, audit jobs).

CI: all green — Build, Dependency Audit, Unit Tests, CodeQL, Socket all pass.

Change is safe: CI action only. v2.2.0 updates the action's own runtime to Node.js 24 and adds AVX2 detection + cache key improvements. The bob CI still requests bun-version: "1.3.10" which is unchanged. No impact on bob's build output or runtime behavior.

Ship it.

[tps-sherlock]

Security/Auth Review — APPROVE ✅

Change: Bumps oven-sh/setup-bun from 2.0.2 to 2.2.0 across 3 locations in .github/workflows/ci.yml (build, test, audit jobs):

-      - uses: oven-sh/setup-bun@735343b667d3e6f658f44d0eca948eb6282f2b76 # v2
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2

Security assessment:

1. Commit hash pinned — both old and new references use full SHA pinning. ✅
2. Trusted source — oven-sh/setup-bun is the official Bun action maintained by Oven (the company behind Bun). ✅
3. No auth/permission changes — with: block unchanged (bun-version: "1.3.10"). No new secrets, tokens, or credential handling introduced. ✅
4. Security-positive changelog — v2.1.2 includes a notable fix: "default token only on public github instance" (xhyrom in #157), which restricts token scope to public GitHub instances only. This is a net security improvement. ✅
5. No workflow-level permission changes — surrounding job configs untouched.

Verdict: Routine, well-pinned dependency bump from a trusted source with a security-positive changelog (token scope restriction in v2.1.2). No security or auth concerns. APPROVE.