chore: migrate to bun + Vite+ toolchain

.github/dependabot.yml

@@ -1,9 +1,16 @@
 version: 2
 updates:
-- package-ecosystem: npm
-  directory: "/"
-  schedule:
-    interval: weekly
-    time: "02:00"
-    timezone: Europe/Berlin
-  open-pull-requests-limit: 10
+  - package-ecosystem: npm
+    directory: "/"
+    schedule:
+      interval: weekly
+      time: "02:00"
+      timezone: Europe/Berlin
+    open-pull-requests-limit: 10
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: weekly
+      time: "02:00"
+      timezone: Europe/Berlin
+    open-pull-requests-limit: 10

.github/workflows/build.yml

@@ -0,0 +1,36 @@
+name: Build
+
+on:
+    push:
+        branches:
+            - main
+    pull_request:
+        branches:
+            - main
+
+permissions: {}
+
+jobs:
+    build:
+        name: Build [vp pack]
+        runs-on: ubuntu-latest
+        permissions:
+            contents: read
+
+        steps:
+            - name: Checkout
+              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+              with:
+                  persist-credentials: false
+            - name: Setup Node.js
+              uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+              with:
+                  node-version-file: .node-version
+            - name: Setup Bun
+              uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
+              with:
+                  bun-version-file: package.json
+            - name: Install dependencies
+              run: bun install --frozen-lockfile
+            - name: Build library
+              run: bun run build

.github/workflows/lint.yml

@@ -5,16 +5,32 @@ on:
         branches:
             - main
     pull_request:
+        branches:
+            - main
+
+permissions: {}
 
 jobs:
     lint:
         name: Lint
         runs-on: ubuntu-latest
+        permissions:
+            contents: read
 
         steps:
-            - uses: actions/checkout@v4
-            - uses: actions/setup-node@v4
+            - name: Checkout
+              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+              with:
+                  persist-credentials: false
+            - name: Setup Node.js
+              uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+              with:
+                  node-version-file: .node-version
+            - name: Setup Bun
+              uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
               with:
-                  node-version-file: '.nvmrc'
-            - run: yarn install
-            - run: yarn lint
+                  bun-version-file: package.json
+            - name: Install dependencies
+              run: bun install --frozen-lockfile
+            - name: Run linter
+              run: bun run lint:check

.github/workflows/publish.yml

@@ -0,0 +1,44 @@
+name: Publish
+
+on:
+    push:
+        tags:
+            - v*.*.*
+    workflow_dispatch:
+
+permissions: {}
+
+jobs:
+    publish:
+        name: Publish to npm
+        runs-on: ubuntu-latest
+        permissions:
+            contents: read
+            id-token: write # for npm provenance
+
+        steps:
+            - name: Checkout
+              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+              with:
+                  persist-credentials: false
+            - name: Setup Node.js
+              uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+              with:
+                  node-version-file: .node-version
+                  registry-url: https://registry.npmjs.org
+            - name: Setup Bun
+              uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
+              with:
+                  bun-version-file: package.json
+            - name: Install dependencies
+              run: bun install --frozen-lockfile
+            - name: Type check
+              run: bun run typecheck
+            - name: Run tests
+              run: bun run test
+            - name: Build library
+              run: bun run build
+            - name: Publish to npm
+              run: npm publish --provenance --access public
+              env:
+                  NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

.github/workflows/test.yml

@@ -1,20 +1,38 @@
-name: Run Tests
+name: Test
 
 on:
     push:
         branches:
             - main
     pull_request:
+        branches:
+            - main
+
+permissions: {}
 
 jobs:
-    lint:
+    test:
         name: Run Tests
         runs-on: macos-latest
+        permissions:
+            contents: read
 
         steps:
-            - uses: actions/checkout@v4
-            - uses: actions/setup-node@v4
+            - name: Checkout
+              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+              with:
+                  persist-credentials: false
+            - name: Setup Node.js
+              uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+              with:
+                  node-version-file: .node-version
+            - name: Setup Bun
+              uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
               with:
-                  node-version-file: '.nvmrc'
-            - run: yarn install
-            - run: yarn test
+                  bun-version-file: package.json
+            - name: Install dependencies
+              run: bun install --frozen-lockfile
+            - name: Type check
+              run: bun run typecheck
+            - name: Run tests
+              run: bun run test

.github/workflows/triage.yml

@@ -0,0 +1,32 @@
+name: Triage PR
+
+on:
+    # `pull_request_target` is required so the title-validator can write
+    # statuses on PRs from forks (under `pull_request`, GitHub forces
+    # GITHUB_TOKEN to read-only for fork PRs). Safe here because this
+    # workflow:
+    #   - never checks out PR code (no actions/checkout),
+    #   - has no `run:` steps that interpolate PR fields,
+    #   - only invokes a SHA-pinned action that reads PR metadata via the API.
+    pull_request_target:
+        branches:
+            - main
+        types:
+            - opened
+            - reopened
+            - edited
+            - synchronize
+            - ready_for_review
+
+permissions: {}
+
+jobs:
+    pr-title:
+        name: Validate PR title [conventional commits]
+        runs-on: ubuntu-latest
+        permissions:
+            pull-requests: read
+        steps:
+            - uses: amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50 # v6.1.1
+              env:
+                  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.node-version

@@ -0,0 +1 @@
+24

.vscode/extensions.json

@@ -1,3 +1,3 @@
 {
-  "recommendations": ["biomejs.biome"]
+  "recommendations": ["oxc.oxc-vscode"]
 }

.vscode/settings.json

@@ -1,6 +1,6 @@
 {
   "editor.codeActionsOnSave": {
-    "source.fixAll.biome": "explicit"
+    "source.fixAll.oxc": "explicit"
   },
-  "editor.defaultFormatter": "biomejs.biome"
+  "editor.defaultFormatter": "oxc.oxc-vscode"
 }

README.md

@@ -26,15 +26,15 @@ This module provides boilerplate for setting up a menubar application using Elec
 ## Installation
 
 ```bash
-yarn add @gitify/menubar
+bun add @gitify/menubar
 ```
 
 ## Usage
 
 Starting with your own new project, run these commands:
 
 ```bash
-$ yarn add @gitify/menubar
+$ bun add @gitify/menubar
 $ touch myApp.js
 $ touch index.html
 ```