step-security/Setup Bun

Download, install, and setup Bun to your path.

Trust Signals

name	description	required	default
bun-version	The version of Bun to install. (e.g. "latest", "canary", "1.0.0", "1.0.x", <sha>)	no	—
bun-version-file	The version of Bun to install from file. (e.g. "package.json", ".bun-version", ".tool-versions")	no	—
bun-download-url	Override the URL to download Bun from. This skips version resolution and verifying AVX2 support.	no	—
registries	List of package registries with authentication support. Format: - Default registry: https://registry.npmjs.org/ - Default with token: https://registry.npmjs.org/\|token - Scoped registry: @scope:https://registry.example.com/ - Scoped with token: @scope:https://registry.example.com/\|token - Scoped with credentials: @scope:https://user:pass@registry.example.com/	no	—
registry-url	The URL of the package registry to use for installing Bun. Set the $BUN_AUTH_TOKEN environment variable to authenticate with the registry.	no	—
scope	The scope for authenticating with the package registry.	no	—
no-cache	Disable caching of bun executable.	no	false
token	Personal access token (PAT) used to fetch tags from oven-sh/bun repository. Recommended for resolving wildcard/range versions to avoid GitHub API rate limiting. When running this action on github.com, the default value is sufficient. When running on GHES, you can pass a personal access token for github.com if you are experiencing rate limiting.	no	${{ github.server_url == 'https://github.com' && github.token \|\| '' }}

name	description
bun-version	The version of Bun that was installed.
bun-revision	The revision of Bun that was installed.
bun-path	The path to the Bun executable.
bun-download-url	The URL from which Bun was downloaded.
cache-hit	If the version of Bun was cached.