From fc7bdcedb4e3f43999898f68949409e6516b458e Mon Sep 17 00:00:00 2001
From: Gabe Pearhill <gabepearhill@google.com>
Date: Fri, 17 Jul 2026 13:35:51 -0700
Subject: [PATCH 1/3] chore: setup unit test CI on Bun

---
 .github/workflows/presubmit-bun.yaml | 34 ++++++++++++++++++++++++++++
 ci/run_single_test.sh                | 12 ++++++----
 2 files changed, 41 insertions(+), 5 deletions(-)
 create mode 100644 .github/workflows/presubmit-bun.yaml

diff --git a/.github/workflows/presubmit-bun.yaml b/.github/workflows/presubmit-bun.yaml
new file mode 100644
index 000000000000..ebad0f26cf3c
--- /dev/null
+++ b/.github/workflows/presubmit-bun.yaml
@@ -0,0 +1,34 @@
+permissions:
+  contents: read
+
+on:
+  pull_request:
+name: presubmit-bun
+jobs:
+  units:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        with:
+          fetch-depth: 300
+          persist-credentials: false
+      # Node.js is required by pnpm for installing dependencies. 
+      - name: Use Node.js 22
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+        with:
+          node-version: 22
+      # We continue to use PNPM (rather than Bun) for installation for consistent 
+      # lockfile/version management between CI/runtimes.
+      - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
+        with:
+          version: ^10.0.0
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
+        with:
+          bun-version: 1.3.14
+      - run: bun --version
+      - run: ci/run_conditional_tests.sh
+        name: Run unit tests with Bun
+        env:
+          BUILD_TYPE: presubmit
+          TEST_TYPE: units
+          TEST_CMD: bun run
diff --git a/ci/run_single_test.sh b/ci/run_single_test.sh
index e78b6411fdae..ec0d8dd22e16 100755
--- a/ci/run_single_test.sh
+++ b/ci/run_single_test.sh
@@ -29,6 +29,8 @@ if [ -z "${TEST_TYPE}" ]; then
     TEST_TYPE="units"
 fi
 
+TEST_CMD=${TEST_CMD:-pnpm}
+
 d=$(pwd)
 PROJECT=$(basename ${d})
 
@@ -69,20 +71,20 @@ fi
 set +e
 case ${TEST_TYPE} in
 lint)
-    pnpm prelint
-    pnpm lint
+    ${TEST_CMD} prelint
+    ${TEST_CMD} lint
     retval=$?
     ;;
 samples)
-    pnpm samples-test
+    ${TEST_CMD} samples-test
     retval=$?
     ;;
 system)
-    pnpm system-test
+    ${TEST_CMD} system-test
     retval=$?
     ;;
 units)
-    pnpm test
+    ${TEST_CMD} test
     retval=$?
     ;;
 *)

From c13ee0dff4b33af79123d57f2cad34990e8a68df Mon Sep 17 00:00:00 2001
From: Gabe Pearhill <gabepearhill@google.com>
Date: Fri, 17 Jul 2026 13:41:46 -0700
Subject: [PATCH 2/3] reenable whole respository testing when CI is modified.

---
 ci/run_conditional_tests.sh | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/ci/run_conditional_tests.sh b/ci/run_conditional_tests.sh
index 5e10d220da66..9e06c59a7891 100755
--- a/ci/run_conditional_tests.sh
+++ b/ci/run_conditional_tests.sh
@@ -61,11 +61,10 @@ set -e
 if [[ "${changed}" -eq 0 ]]; then
     echo "no change detected in ci"
 else
-    echo "skipping trigger of tests for now: tracking in #7540"
-    # echo "change detected in ci, we should test everything"
-    # echo "result of git diff ${GIT_DIFF_ARG} ci:"
-    # git diff ${GIT_DIFF_ARG} ci
-    # GIT_DIFF_ARG=""
+    echo "change detected in ci, we should test everything"
+    echo "result of git diff ${GIT_DIFF_ARG} ci:"
+    git diff ${GIT_DIFF_ARG} ci
+    GIT_DIFF_ARG=""
 fi
 
 # Now we have a fixed list, but we can change it to autodetect if

From e96e1596cec6a181591a4bbdb12bba483e682c76 Mon Sep 17 00:00:00 2001
From: Gabe Pearhill <gabepearhill@google.com>
Date: Wed, 22 Jul 2026 14:36:26 -0700
Subject: [PATCH 3/3] fix commit hashes for zizmor

---
 .github/workflows/presubmit-bun.yaml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/presubmit-bun.yaml b/.github/workflows/presubmit-bun.yaml
index ebad0f26cf3c..b9fbf4acfec3 100644
--- a/.github/workflows/presubmit-bun.yaml
+++ b/.github/workflows/presubmit-bun.yaml
@@ -8,15 +8,15 @@ jobs:
   units:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
         with:
           fetch-depth: 300
           persist-credentials: false
       # Node.js is required by pnpm for installing dependencies. 
-      - name: Use Node.js 22
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+      - name: Use Node.js 24
+        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
         with:
-          node-version: 22
+          node-version: 24
       # We continue to use PNPM (rather than Bun) for installation for consistent 
       # lockfile/version management between CI/runtimes.
       - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4