build: migrate package manager from pnpm to bun

[qyinm]

Summary

This PR migrates the JavaScript/TypeScript monorepo (apps/web, packages/*) from pnpm to Bun (bun@1.3.14).

• 8.4x faster cold install (30.58s → 3.62s) and 34.7x faster warm install (1.09s → 0.031s).
• 1.9x faster Web test suite execution (28.65s → 15.27s for 156 Vitest tests).
• ~35% to 47% reduction in total CI runtime (GitHub Actions web job: 78s → 51s on warm cache, 101s → 54s on cold cache).
• 78% reduction in lockfile lines (6,338 lines in pnpm-lock.yaml → 1,353 lines in text-based bun.lock).

---

Why

1. Eliminate CI Bottlenecks & Accelerate Local DX:
   Dependency installation and module resolution in large monorepos introduce noticeable latency during local iterations and CI pipelines. Bun's native Zig/C++ runtime provides near-instantaneous zero-network installs (121ms) and faster file I/O for test suites.
2. Simplified Monorepo & Configuration:
   Bun natively supports workspaces and the workspace:* dependency protocol directly within package.json, removing the need for a separate pnpm-workspace.yaml.
3. Readable & Merge-Friendly Lockfile:
   Bun 1.2+ uses a standardized, human-readable text lockfile (bun.lock), significantly reducing PR diff fatigue and git merge conflicts.
4. Zero-Friction Compatibility:
   Retains 100% compatibility with Next.js 16 (Turbopack), React 19, Vitest with jsdom / Testing Library, Better Auth, and ESLint 9 without modifying application code.

Empirical Benchmarks (Local & CI)

Metric	pnpm	Bun	Improvement
Cold Install (node_modules clean install)	30.58s	3.62s	🚀 8.4x faster (844%)
Warm Install (dependency sync check)	1.09s	0.031s	⚡ 34.7x faster (3,470%)
Web Test Suite (156 Vitest tests)	28.65s	15.27s	🏎️ 1.9x faster (187%)
API Client Tests (16 Vitest tests)	1.45s	1.32s	✨ 1.1x faster
CI Toolchain Setup	~7.5s	~2.2s	⚡ ~70% faster
Total CI Job (web) — Warm Cache	~78s (1m 18s)	~51s	🎯 ~35% faster (saves ~27s per PR)
Total CI Job (web) — Cold Cache	~101s (1m 41s)	~54s	🎯 ~47% faster (saves ~47s)
Lockfile Line Count	6,338 lines	1,353 lines	📉 78% reduction

---

Changes

1. Workspace Configuration & Lockfile

• Updated root package.json to declare "packageManager": "bun@1.3.14", "workspaces": ["apps/web", "packages/*"], and migrated security patch overrides (brace-expansion, postcss, sharp).
• Removed pnpm-workspace.yaml and pnpm-lock.yaml.
• Generated and tracked the new text-based bun.lock.

2. Task Runners (justfile)

• Updated install, dev-web, test-api-client, test-web, lint-web, and build-web targets to use bun and bun --filter.

3. CI/CD Workflow (.github/workflows/ci.yml)

• Replaced pnpm/action-setup and Node.js setup/caching with oven-sh/setup-bun@v2 (SHA pinned).
• Added global package cache step using actions/cache@v4 targeting ~/.bun/install/cache with bun-${{ runner.os }}-${{ hashFiles('bun.lock') }}.

4. Git Ignore & Documentation

• Updated root .gitignore (.pnpm-store/ → .bun/) and apps/web/.gitignore (removed .pnpm-debug.log*).
• Updated development setup and install instructions across README.md and README.ko.md.

---

Verification

All repository-level gates were verified locally:

just install # Checked in 121ms
just lint # ESLint passed with 0 errors / 0 warnings
just test-api-client # 16 passed
just test-web # 26 test files / 156 passed
just build-web # Next.js Turbopack production build succeeded

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
plot-web	Ready	Preview	Aug 20, 2026 2:46pm