chore: pin Bun version via .bun-version (#69)

Replace deploy.sh's `bun upgrade` with a pinned install driven by the
new `.bun-version` file (currently 1.3.6), and point every CI
`setup-bun` step at the same file via `bun-version-file`. Dev, CI, and
prod now stay in lockstep, and a Bun release can't reach the host
without first being vetted in CI.

Author: Archasion

.bun-version

@@ -0,0 +1 @@
+1.3.6

.github/workflows/ci.yml

@@ -18,6 +18,8 @@ jobs:
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+        with:
+          bun-version-file: .bun-version
 
       - name: Install Dependencies
         run: bun install --frozen-lockfile
@@ -29,6 +31,8 @@ jobs:
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+        with:
+          bun-version-file: .bun-version
 
       - name: Install Dependencies
         run: bun install --frozen-lockfile
@@ -44,6 +48,8 @@ jobs:
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+        with:
+          bun-version-file: .bun-version
 
       - name: Install Dependencies
         run: bun install --frozen-lockfile
@@ -74,6 +80,8 @@ jobs:
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+        with:
+          bun-version-file: .bun-version
 
       - name: Install Dependencies
         run: bun install --frozen-lockfile
@@ -85,6 +93,8 @@ jobs:
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+        with:
+          bun-version-file: .bun-version
 
       - name: Install Dependencies
         run: bun install --frozen-lockfile

scripts/deploy.sh

@@ -10,10 +10,20 @@ set -euo pipefail
 # `bun` and `pm2` resolve regardless of how this script was invoked.
 export PATH="$HOME/.bun/bin:$HOME/.local/bin:/usr/local/bin:$PATH"
 
-# Keep the host's Bun current. Lockfiles are written by recent Bun in dev
-# and CI; an older host Bun fails to parse them ("Outdated lockfile
-# version"). `bun upgrade` is idempotent and safe when already current.
-bun upgrade
+# Pin the host's Bun to the version recorded in `.bun-version`. CI uses
+# the same file via `oven-sh/setup-bun`, so dev/CI/prod stay in lockstep
+# and we never silently pull a Bun release that hasn't been vetted in CI
+# first. If `.bun-version` is absent (e.g. when running this script from
+# a stale checkout) we fall back to the currently installed Bun.
+PIN="$(cat .bun-version 2>/dev/null | tr -d '[:space:]')"
+if [ -n "$PIN" ]; then
+  if [ "$(bun --version 2>/dev/null)" != "$PIN" ]; then
+    echo "Pinning Bun to $PIN (current: $(bun --version 2>/dev/null || echo none))"
+    curl -fsSL https://bun.sh/install | bash -s "bun-v$PIN"
+  fi
+else
+  echo "WARNING: .bun-version missing; using installed Bun $(bun --version)"
+fi
 
 BACKUPS_DIR="prisma/backups"
 KEEP_BACKUPS=3