From 6b93fbfd65ddb1535b31e5c297cbfd6ad386d1c3 Mon Sep 17 00:00:00 2001
From: acamq <179265037+acamq@users.noreply.github.com>
Date: Mon, 11 May 2026 16:18:19 -0600
Subject: [PATCH] ci: enforce frozen bun installs

---
 .github/workflows/ci.yml                         | 6 +++---
 .github/workflows/publish-platform.yml           | 2 +-
 .github/workflows/publish.yml                    | 8 ++++----
 .github/workflows/refresh-model-capabilities.yml | 2 +-
 .github/workflows/sisyphus-agent.yml             | 2 +-
 5 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 361ce4c59..8ea728771 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -42,7 +42,7 @@ jobs:
           bun-version: "1.3.12"
 
       - name: Install dependencies
-        run: bun install
+        run: bun install --frozen-lockfile
         env:
           BUN_INSTALL_ALLOW_SCRIPTS: "@ast-grep/napi"
 
@@ -59,7 +59,7 @@ jobs:
           bun-version: "1.3.12"
 
       - name: Install dependencies
-        run: bun install
+        run: bun install --frozen-lockfile
         env:
           BUN_INSTALL_ALLOW_SCRIPTS: "@ast-grep/napi"
 
@@ -84,7 +84,7 @@ jobs:
           bun-version: "1.3.12"
 
       - name: Install dependencies
-        run: bun install
+        run: bun install --frozen-lockfile
         env:
           BUN_INSTALL_ALLOW_SCRIPTS: "@ast-grep/napi"
 
diff --git a/.github/workflows/publish-platform.yml b/.github/workflows/publish-platform.yml
index 7d4b5a8e7..cd2b16b6f 100644
--- a/.github/workflows/publish-platform.yml
+++ b/.github/workflows/publish-platform.yml
@@ -52,7 +52,7 @@ jobs:
           bun-version: latest
 
       - name: Install dependencies
-        run: bun install
+        run: bun install --frozen-lockfile
         env:
           BUN_INSTALL_ALLOW_SCRIPTS: "@ast-grep/napi"
 
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index fc50d007f..18f18f696 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -41,7 +41,7 @@ jobs:
           bun-version: "1.3.11"
 
       - name: Install dependencies
-        run: bun install
+        run: bun install --frozen-lockfile
         env:
           BUN_INSTALL_ALLOW_SCRIPTS: "@ast-grep/napi"
 
@@ -58,7 +58,7 @@ jobs:
           bun-version: "1.3.11"
 
       - name: Install dependencies
-        run: bun install
+        run: bun install --frozen-lockfile
         env:
           BUN_INSTALL_ALLOW_SCRIPTS: "@ast-grep/napi"
 
@@ -159,7 +159,7 @@ jobs:
         run: npm install -g npm@latest
 
       - name: Install dependencies
-        run: bun install
+        run: bun install --frozen-lockfile
         env:
           BUN_INSTALL_ALLOW_SCRIPTS: "@ast-grep/napi"
 
@@ -326,7 +326,7 @@ jobs:
           bun-version: latest
 
       - name: Install dependencies
-        run: bun install
+        run: bun install --frozen-lockfile
         env:
           BUN_INSTALL_ALLOW_SCRIPTS: "@ast-grep/napi"
 
diff --git a/.github/workflows/refresh-model-capabilities.yml b/.github/workflows/refresh-model-capabilities.yml
index dd34e43ed..d21a2d661 100644
--- a/.github/workflows/refresh-model-capabilities.yml
+++ b/.github/workflows/refresh-model-capabilities.yml
@@ -21,7 +21,7 @@ jobs:
           bun-version: latest
 
       - name: Install dependencies
-        run: bun install
+        run: bun install --frozen-lockfile
         env:
           BUN_INSTALL_ALLOW_SCRIPTS: "@ast-grep/napi"
 
diff --git a/.github/workflows/sisyphus-agent.yml b/.github/workflows/sisyphus-agent.yml
index 7c83e3151..80e5af297 100644
--- a/.github/workflows/sisyphus-agent.yml
+++ b/.github/workflows/sisyphus-agent.yml
@@ -74,7 +74,7 @@ jobs:
       # Build local oh-my-opencode
       - name: Build oh-my-opencode
         run: |
-          bun install
+          bun install --frozen-lockfile
           bun run build
 
       # Install OpenCode + configure local plugin + auth in single step