Production engineering baseline

Verification snapshot: 2026-08-02, stable Bun 1.3.14. Production repositories should pin a team-validated stable version or image digest, not this page's version forever.

What the baseline solves

This baseline separates “Bun can run the code” from “the project is safe to release.” Bun executes TypeScript, but type checking, linting, tests, database migrations, image scanning, and rollback remain explicit responsibilities.

{
  "name": "bun-service",
  "private": true,
  "type": "module",
  "packageManager": "bun@1.3.14",
  "scripts": {
    "dev": "bun --watch src/index.ts",
    "start": "bun run --no-env-file dist/index.js",
    "typecheck": "tsc --noEmit",
    "check": "biome check .",
    "test": "bun test --isolate",
    "test:ci": "bun test --parallel --coverage",
    "build": "bun build src/index.ts --target=bun --production --outdir=dist",
    "ci": "bun run typecheck && bun run check && bun run test:ci && bun run build"
  },
  "trustedDependencies": []
}

The example chooses Biome as one explicit lint/format owner and requires its development dependency. A repository with an established ESLint or Oxlint workflow should replace the check command instead of running a second set of mostly duplicate rules.

Starting in TypeScript 6.0, all @types/* packages are no longer discovered automatically. Install @types/bun and explicitly add "types": ["bun"] when using Bun globals. Add Node, test-framework, or React types to the same array when the project needs them.

Reproducible CI

name: ci
on: [push, pull_request]

jobs:
  verify:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: 1.3.14
      - run: bun ci
      - run: bun run ci

bun ci is equivalent to bun install --frozen-lockfile. minimumReleaseAge affects newly resolved versions, not packages already present in bun.lock; security upgrades still require an explicit reviewed lockfile change.

Install scripts are code-execution grants

bun pm untrusted
bun pm trust <reviewed-package>
bun audit

Only add dependencies that genuinely require reviewed build steps to trustedDependencies. Since Bun 1.2.21, bun audit --prod audits production dependencies only, but the --production / --omit=dev spellings are not supported, and filtering has a known defect at workspace roots (oven-sh/bun#26675); verify its output in your actual repository layout before gating CI on it. --exact pins a direct dependency range; bun.lock makes the complete dependency graph reproducible. They are not substitutes.

Production environment variables

Bun loads .env files by default. When a container or managed platform already injects production configuration, use --no-env-file to avoid reading a local file copied into the image or mounted directory:

bun run --no-env-file dist/index.js

Validate required variables at startup. Log variable names and status, never values. Server secrets must not enter browser bundles, error pages, traces, or agent context.

Release gates

• Type checks, lint, unit, integration, and end-to-end tests.
• Migration rehearsal against the target database and a rollback plan.
• Startup tests on the target OS, CPU, libc, and Bun version.
• SIGTERM, long-connection shutdown, and readiness drain tests.
• Container and dependency vulnerability scans.
• Cold-start, memory, concurrency, and sustained-load tests.
• Canary builds stay in isolated compatibility testing and never bypass stable release gates.

Official references: TypeScript 6/7, bun install, test configuration, and environment variables.