ci(lint): install dependencies before running oxlint

[robobun]

The Lint workflow has been failing on every PR with:

$ oxlint --config=oxlint.json --format=github src/js
/usr/bin/bash: line 1: oxlint: command not found
error: script "lint" exited with code 127

#32522 pinned oxlint as a devDependency and changed the lint script from bunx oxlint to bare oxlint, but lint.yml never ran bun install, so the binary was never on PATH.

This adds a Setup Dependencies step (matching format.yml / clippy.yml) that runs bun install --frozen-lockfile before linting.

Verified locally:

$ bun install --frozen-lockfile && bun lint
Found 0 warnings and 0 errors.
Finished in 471ms on 199 files with 88 rules using 12 threads.

[robobun]

^{Updated 2:56 AM PT - Jun 21st, 2026}

❌ @robobun, your commit 9538c1d has 1 failures in Build #63743 (All Failures):

• test/js/web/websocket/autobahn.test.ts - code 1 on 🍎 14 aarch64

---

🧪   To try this PR locally:

bunx bun-pr 32555

That installs a local version of the PR into your bun-32555 executable, so you can run:

bun-32555 --bun

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: edc618ec-bc81-4c9b-a8cb-500ef395e5f9

📥 Commits

Reviewing files that changed from the base of the PR and between febcc24 and 9538c1d.

📒 Files selected for processing (1)

• .github/workflows/lint.yml

---

Walkthrough

A new "Setup Dependencies" step running bun install --frozen-lockfile is inserted into the GitHub Actions lint workflow, positioned after the Bun setup step and before the lint execution step.

Changes

Lint Workflow Dependency Install

Layer / File(s)	Summary
Add Setup Dependencies step .github/workflows/lint.yml	Inserts a bun install --frozen-lockfile step after Bun setup and before the lint command runs.

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title directly and clearly summarizes the main change: adding a dependency installation step to the lint CI workflow before running oxlint.
Description check	✅ Passed	The description provides context about the issue, explains the root cause, describes the solution, and includes local verification results. However, it doesn't follow the repository's template structure with 'What does this PR do?' and 'How did you verify your code works?' sections.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[claude]

LGTM — straightforward CI fix matching the existing pattern in other workflows.

Extended reasoning...

Overview

This PR adds a single Setup Dependencies step to .github/workflows/lint.yml that runs bun install --frozen-lockfile before the Lint step. The lint script in package.json invokes bare oxlint (not bunx oxlint), so the devDependency binary must be installed into node_modules/.bin for it to be on PATH. Without this step, the workflow fails with oxlint: command not found (exit 127), as described.

Security risks

None. The added command is bun install --frozen-lockfile, which is already run identically in clippy.yml and miri.yml in this repo. It uses --frozen-lockfile, so it cannot mutate the lockfile or pull unpinned versions. There is no new external input, no secrets, no permission changes, and no change to what the workflow runs against.

Level of scrutiny

Low. This is a 3-line, mechanical CI infrastructure fix that copies an established pattern verbatim from sibling workflows. It does not touch product code, tests, or build outputs — it only unbreaks a lint job that currently fails before doing any linting at all.

Other factors

I verified that package.json's lint script is indeed oxlint --config=oxlint.json --format=github src/js (bare binary), confirming the root cause and the fix. The step name and structure mirror the existing Setup Dependencies steps elsewhere in .github/workflows/. No bugs were flagged by the bug-hunting system, and there are no outstanding reviewer comments.