From 22562ea85989b9c5717e604fd8a6cf0ab2890207 Mon Sep 17 00:00:00 2001
From: Leo <cheerleaderleo@outlook.com>
Date: Mon, 21 Sep 2026 22:50:34 -0700
Subject: [PATCH] ci: pin Bun across web validation jobs

---
 .github/workflows/ci-web.yml  |  8 ++++++++
 tests/test_ci_change_areas.py | 11 +++++++++++
 2 files changed, 19 insertions(+)
 mode change 100755 => 100644 tests/test_ci_change_areas.py

diff --git a/.github/workflows/ci-web.yml b/.github/workflows/ci-web.yml
index 92927f589475..6757822e86d2 100644
--- a/.github/workflows/ci-web.yml
+++ b/.github/workflows/ci-web.yml
@@ -202,6 +202,8 @@ jobs:
 
       - name: Setup Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+        with:
+          bun-version: "1.3.14"
 
       - name: Verify generated webviews assets
         run: ./scripts/build-webviews-app.sh --check
@@ -242,6 +244,8 @@ jobs:
 
       - name: Setup Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+        with:
+          bun-version: "1.3.14"
 
       - name: Install webview dependencies
         working-directory: webviews
@@ -290,6 +294,8 @@ jobs:
 
       - name: Setup Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+        with:
+          bun-version: "1.3.14"
 
       - name: Install dependencies
         run: bun install --frozen-lockfile
@@ -323,6 +329,8 @@ jobs:
 
       - name: Setup Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+        with:
+          bun-version: "1.3.14"
 
       - name: Build and test Agent Session web resources
         run: |
diff --git a/tests/test_ci_change_areas.py b/tests/test_ci_change_areas.py
old mode 100755
new mode 100644
index d17b2d4e6c2a..db0b316e21aa
--- a/tests/test_ci_change_areas.py
+++ b/tests/test_ci_change_areas.py
@@ -1253,6 +1253,17 @@ def test_required_tests_status_waits_for_platform_workflows() -> None:
     assert 'web_result not in {"success", "skipped"}' in block
 
 
+
+def test_web_workflow_pins_every_bun_setup_version() -> None:
+    workflow = WEB_WORKFLOW.read_text(encoding="utf-8")
+    action = "uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6"
+    blocks = workflow.split(action)
+    assert len(blocks) > 1
+    for suffix in blocks[1:]:
+        setup_tail = suffix.split("\n      - name: ", 1)[0]
+        assert '          bun-version: "1.3.14"' in setup_tail
+
+
 def test_web_typecheck_retries_native_tsgo_abort() -> None:
     script = workflow_job_step_script("web-typecheck", "Typecheck", WEB_WORKFLOW)