Distillation

<observations> Date: June 9, 2026

🟡 (11:46) Agent fetched oven-sh/bun .github/workflows/release.yml (368 lines, 12.9 KB) — full content reviewed
🟡 (11:46) bun release.yml env vars: BUN_VERSION set from github.event.inputs.tag OR github.event.release.tag_name OR 'canary'; BUN_LATEST set from github.event.inputs.is-latest OR github.event.release.tag_name
🟡 (11:46) bun release.yml triggers: release (published), schedule (cron "0 14 * * *" = 6am PST daily), workflow_dispatch (inputs: is-latest bool, tag string required, use-docker bool, use-npm bool, use-homebrew bool, use-s3 bool, use-types bool, use-definitelytyped bool)
🟡 (11:46) bun release.yml jobs: sign, npm, npm-types, definitelytyped, docker, homebrew, s3, notify-sentry, bump — all conditioned on github.repository_owner == 'oven-sh' (sign job)
🟡 (11:46) bun release.yml sign job: runs-on ubuntu-latest; uses crazy-max/ghaction-import-gpg@d6f3f49f; bun-version "1.2.3"; runs bun upload-assets -- "$BUN_VERSION"; secrets: GPG_PRIVATE_KEY, GPG_PASSPHRASE, GITHUB_TOKEN; working-directory packages/bun-release
🟡 (11:46) bun release.yml npm job: needs sign; runs bun upload-npm -- "$BUN_VERSION" publish; secrets: GITHUB_TOKEN, NPM_TOKEN; checkout with ref: main (workaround for issue)
🟡 (11:46) bun release.yml npm-types job: needs sign; working-directory packages/bun-types; uses JS-DevTools/npm-publish@0f451a94; canary release uses tag: canary; latest release only when BUN_LATEST == 'true'; bun-version "canary" when BUN_VERSION == 'canary', else "1.2.3"
🟡 (11:46) bun release.yml definitelytyped job: needs npm-types; checks out DefinitelyTyped/DefinitelyTyped; uses bun to update ./types/bun/package.json bun-types dependency version; creates PR via peter-evans/create-pull-request@22a9089 to oven-sh/DefinitelyTyped fork; branch named after BUN_VERSION; only when BUN_LATEST == 'true' && BUN_VERSION != 'canary'; uses ROBOBUN_TOKEN
🟡 (11:46) bun release.yml docker job: needs sign; matrix: debian (suffix ""), debian (suffix -debian), slim (suffix -slim, dir debian-slim), alpine (suffix -alpine), distroless (suffix -distroless); platforms linux/amd64,linux/arm64; pushes to oven/bun on Dockerhub; uses docker/setup-qemu-action, docker/setup-buildx-action, docker/metadata-action, docker/build-push-action
🟡 (11:46) bun release.yml homebrew job: needs sign; checks out oven-sh/homebrew-bun with ROBOBUN_TOKEN; ruby 2.6; runs ruby scripts/release.rb "$BUN_VERSION"; commits with GPG sign via stefanzweifel/git-auto-commit-action; commit_user_name: robobun, commit_user_email: robobun@oven.sh
🟡 (11:46) bun release.yml s3 job: needs sign; runs bun upload-s3 -- "$BUN_VERSION"; secrets: GITHUB_TOKEN, AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_ENDPOINT; AWS_BUCKET: bun; bun-version "1.2.0"
🟡 (11:46) bun release.yml notify-sentry job: needs s3; uses getsentry/action-release@e769183; ignore_missing: true, ignore_empty: true; environment: production
🟡 (11:46) bun release.yml bump job: if github.event_name != 'schedule'; uses ./.github/actions/bump with version and token; only runs steps when BUN_LATEST == 'true'; permissions: pull

Distillation

Observations