From 8ef877db073aed0f83fc83b087308689d9738d78 Mon Sep 17 00:00:00 2001 From: Waleed Latif Date: Fri, 30 Oct 2026 13:50:37 -0700 Subject: [PATCH] chore(trigger): run tasks on the bun-1.4 runtime --- .github/workflows/ci.yml | 4 +-- .github/workflows/trigger-dev.yml | 4 +-- apps/sim/package.json | 6 ++--- apps/sim/trigger.config.ts | 40 +++++++++++++++++++++++++++++- bun.lock | 20 +++++---------- docker/app.Dockerfile | 3 ++- packages/security/src/tls-trust.ts | 6 ++--- 7 files changed, 57 insertions(+), 26 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 7692345fa9b..d6272966178 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -287,7 +287,7 @@ jobs: if [ -n "$TRIGGER_BRANCH" ]; then TARGET_ARGS+=(--branch "$TRIGGER_BRANCH") fi - bunx trigger.dev@4.7.6 deploy "${TARGET_ARGS[@]}" --skip-promotion + bunx trigger.dev@4.8.2 deploy "${TARGET_ARGS[@]}" --skip-promotion - name: Validate deployment version output env: @@ -638,7 +638,7 @@ jobs: if [ -n "$TRIGGER_BRANCH" ]; then TARGET_ARGS+=(--branch "$TRIGGER_BRANCH") fi - bunx trigger.dev@4.7.6 promote "$VERSION" "${TARGET_ARGS[@]}" + bunx trigger.dev@4.8.2 promote "$VERSION" "${TARGET_ARGS[@]}" # Production only, once the new app serves traffic: submit the library and comparison URLs this # push changed to IndexNow. Best effort: nothing depends on it, and a failure never fails the run. diff --git a/.github/workflows/trigger-dev.yml b/.github/workflows/trigger-dev.yml index 26953c129d9..4ad1d348200 100644 --- a/.github/workflows/trigger-dev.yml +++ b/.github/workflows/trigger-dev.yml @@ -41,7 +41,7 @@ jobs: set -euo pipefail : "${TRIGGER_ACCESS_TOKEN:?TRIGGER_ACCESS_TOKEN_PREVIEW or TRIGGER_ACCESS_TOKEN must be configured}" : "${TRIGGER_PROJECT_ID:?TRIGGER_PROJECT_ID must be configured}" - bunx trigger.dev@4.7.6 deploy --env preview --branch dev-sim --skip-promotion + bunx trigger.dev@4.8.2 deploy --env preview --branch dev-sim --skip-promotion - name: Promote current dev preview working-directory: ./apps/sim @@ -61,4 +61,4 @@ jobs: echo "::notice::Skipping superseded dev task version $VERSION" exit 0 fi - bunx trigger.dev@4.7.6 promote "$VERSION" --env preview --branch dev-sim + bunx trigger.dev@4.8.2 promote "$VERSION" --env preview --branch dev-sim diff --git a/apps/sim/package.json b/apps/sim/package.json index f99a1c9675f..d78c34fd9e3 100644 --- a/apps/sim/package.json +++ b/apps/sim/package.json @@ -174,8 +174,8 @@ "@tiptap/starter-kit": "3.31.4", "@tiptap/suggestion": "3.31.4", "@tiptap/y-tiptap": "3.0.7", - "@trigger.dev/core": "4.7.6", - "@trigger.dev/sdk": "4.7.6", + "@trigger.dev/core": "4.8.2", + "@trigger.dev/sdk": "4.8.2", "@typescript/typescript6": "^6.0.2", "@xterm/addon-fit": "0.11.0", "@xterm/addon-unicode11": "0.9.0", @@ -295,7 +295,7 @@ "@tailwindcss/postcss": "^4.3.3", "@tailwindcss/typography": "0.5.20", "@testing-library/jest-dom": "^6.10.0", - "@trigger.dev/build": "4.7.6", + "@trigger.dev/build": "4.8.2", "@types/archiver": "8.0.0", "@types/busboy": "1.5.4", "@types/chrome": "0.3.6", diff --git a/apps/sim/trigger.config.ts b/apps/sim/trigger.config.ts index 156c15712f7..02107306cd9 100644 --- a/apps/sim/trigger.config.ts +++ b/apps/sim/trigger.config.ts @@ -4,6 +4,7 @@ import { OTLPTraceExporter } from '@opentelemetry/exporter-trace-otlp-http' import { resourceFromAttributes } from '@opentelemetry/resources' import { createLogger } from '@sim/logger' import { distrustCompromisedRoots } from '@sim/security/tls-trust' +import type { BuildExtension } from '@trigger.dev/build' import { additionalFiles, additionalPackages, @@ -65,6 +66,42 @@ function getFunctionExecutionEnvVars() { }) } +/** + * Node.js version copied into the task image, in lockstep with `NODE_VERSION` + * in `docker/app.Dockerfile`: `isolated-vm` 6.x loads its Node 24 (ABI 137) + * prebuild. The image is pinned by its multi-arch index digest. + */ +const NODE_VERSION = '24.22.1' +const NODE_IMAGE = `node:${NODE_VERSION}-bookworm-slim@sha256:be8204d4bd327363357f532187b752ff62759c31bedf98e9e18fc08c9cbd605c` + +/** + * Tasks run on Bun, but the `bun-1.4` image ships no `node`, and the + * isolated-vm sandbox worker and the Oracle Database worker are spawned as + * `node` child processes, the same split as the app image. Adding image + * instructions also builds the install stage from this base, so `bun install` + * runs `isolated-vm`'s install script against the same Node. Deploy only: + * `trigger dev` spawns the developer's own `node`. + * + * @see https://trigger.dev/docs/guides/frameworks/bun#choosing-a-bun-runtime + */ +function nodeBinary(): BuildExtension { + return { + name: 'node-binary', + onBuildComplete(context) { + if (context.target === 'dev') return + context.addLayer({ + id: 'node-binary', + image: { + instructions: [ + `COPY --from=${NODE_IMAGE} /usr/local/bin/node /usr/local/bin/node`, + `RUN [ "$(node --version)" = "v${NODE_VERSION}" ]`, + ], + }, + }) + }, + } +} + const grafanaTelemetry = grafanaFullyConfigured ? (() => { const baseUrl = grafanaEndpoint!.replace(/\/+$/, '') @@ -88,7 +125,7 @@ const grafanaTelemetry = grafanaFullyConfigured export default defineConfig({ project: env.TRIGGER_PROJECT_ID!, - runtime: 'node-24', + runtime: 'bun-1.4', logLevel: 'info', maxDuration: 5400, retries: { @@ -159,6 +196,7 @@ export default defineConfig({ 'sharp', ], extensions: [ + nodeBinary(), syncEnvVars(() => [ { name: 'DB_APP_NAME', value: 'sim-trigger' }, /** diff --git a/bun.lock b/bun.lock index 78930e39690..3a78e08a681 100644 --- a/bun.lock +++ b/bun.lock @@ -313,8 +313,8 @@ "@tiptap/starter-kit": "3.31.4", "@tiptap/suggestion": "3.31.4", "@tiptap/y-tiptap": "3.0.7", - "@trigger.dev/core": "4.7.6", - "@trigger.dev/sdk": "4.7.6", + "@trigger.dev/core": "4.8.2", + "@trigger.dev/sdk": "4.8.2", "@typescript/typescript6": "^6.0.2", "@xterm/addon-fit": "0.11.0", "@xterm/addon-unicode11": "0.9.0", @@ -433,7 +433,7 @@ "@tailwindcss/postcss": "^4.3.3", "@tailwindcss/typography": "0.5.20", "@testing-library/jest-dom": "^6.10.0", - "@trigger.dev/build": "4.7.6", + "@trigger.dev/build": "4.8.2", "@types/archiver": "8.0.0", "@types/busboy": "1.5.4", "@types/chrome": "0.3.6", @@ -2222,11 +2222,11 @@ "@tootallnate/once": ["@tootallnate/once@2.0.1", "", {}, "sha512-HqmEUIGRJ5fSXchkVgR5F7qn48bDBzv0kWj/Kfu5e6uci4UlEeng4331LnBkWffb++Ei3FOVLxo8JJWMFBDMeQ=="], - "@trigger.dev/build": ["@trigger.dev/build@4.7.6", "", { "dependencies": { "@prisma/config": "^6.10.0", "@trigger.dev/core": "4.7.6", "mlly": "^1.7.1", "pkg-types": "^1.1.3", "tinyglobby": "^0.2.2", "tsconfck": "3.1.3" }, "peerDependencies": { "@typescript/typescript6": "^6.0.0", "typescript": ">=5.0.0" }, "optionalPeers": ["@typescript/typescript6", "typescript"] }, "sha512-9sPZ7KWlin231cWHgQjRl/HuSx3zlW4ptLahAuWMEiwdmHaH2SFdTEGRJ/pMbFcgcsulv9ge6Rj+H/2jLHhnRA=="], + "@trigger.dev/build": ["@trigger.dev/build@4.8.2", "", { "dependencies": { "@prisma/config": "^6.10.0", "@trigger.dev/core": "4.8.2", "mlly": "^1.7.1", "pkg-types": "^1.1.3", "tinyglobby": "^0.2.2", "tsconfck": "3.1.3" }, "peerDependencies": { "@typescript/typescript6": "^6.0.0", "typescript": ">=5.0.0" }, "optionalPeers": ["@typescript/typescript6", "typescript"] }, "sha512-mxyisGjBxJPqrCuoe3sqlTgQ7Oc1mgMbUkxzp6uXQX1maPxtbYUkFp/6nPEargc3ul331jxSP8smtatFqtSy5g=="], - "@trigger.dev/core": ["@trigger.dev/core@4.7.6", "", { "dependencies": { "@bugsnag/cuid": "^3.1.1", "@electric-sql/client": "1.0.14", "@google-cloud/precise-date": "^4.0.0", "@jsonhero/path": "^1.0.21", "@opentelemetry/api": "1.9.1", "@opentelemetry/api-logs": "0.219.0", "@opentelemetry/core": "2.8.0", "@opentelemetry/exporter-logs-otlp-http": "0.219.0", "@opentelemetry/exporter-metrics-otlp-http": "0.219.0", "@opentelemetry/exporter-trace-otlp-http": "0.219.0", "@opentelemetry/host-metrics": "^0.38.3", "@opentelemetry/instrumentation": "0.219.0", "@opentelemetry/resources": "2.8.0", "@opentelemetry/sdk-logs": "0.219.0", "@opentelemetry/sdk-metrics": "2.8.0", "@opentelemetry/sdk-trace-base": "2.8.0", "@opentelemetry/sdk-trace-node": "2.8.0", "@s2-dev/streamstore": "0.25.0", "dequal": "^2.0.3", "eventsource": "^3.0.5", "eventsource-parser": "^3.0.0", "humanize-duration": "^3.27.3", "jose": "^5.4.0", "nanoid": "3.3.18", "prom-client": "^15.1.0", "socket.io-client": "4.7.5", "std-env": "^3.8.1", "tinyexec": "^0.3.2", "uncrypto": "^0.1.3", "zod": "^3.25.56 || ^4.0.0", "zod-validation-error": "^5.0.0" } }, "sha512-0FgDkorx6xjKK8VRoyxJYb5eKJzpvQ0vxLKCaRbZKYRC+DB1h7gqAf7RQMdlQENYZQA6ALxO+fMcV9oXj5kZrw=="], + "@trigger.dev/core": ["@trigger.dev/core@4.8.2", "", { "dependencies": { "@bugsnag/cuid": "^3.1.1", "@electric-sql/client": "1.0.14", "@google-cloud/precise-date": "^4.0.0", "@jsonhero/path": "^1.0.21", "@opentelemetry/api": "1.9.1", "@opentelemetry/api-logs": "0.219.0", "@opentelemetry/core": "2.8.0", "@opentelemetry/exporter-logs-otlp-http": "0.219.0", "@opentelemetry/exporter-metrics-otlp-http": "0.219.0", "@opentelemetry/exporter-trace-otlp-http": "0.219.0", "@opentelemetry/host-metrics": "^0.38.3", "@opentelemetry/instrumentation": "0.219.0", "@opentelemetry/resources": "2.8.0", "@opentelemetry/sdk-logs": "0.219.0", "@opentelemetry/sdk-metrics": "2.8.0", "@opentelemetry/sdk-trace-base": "2.8.0", "@opentelemetry/sdk-trace-node": "2.8.0", "@s2-dev/streamstore": "0.25.0", "dequal": "^2.0.3", "eventsource": "^3.0.5", "eventsource-parser": "^3.0.0", "humanize-duration": "^3.27.3", "jose": "^5.4.0", "nanoid": "3.3.18", "prom-client": "^15.1.0", "socket.io-client": "4.8.4", "std-env": "^3.8.1", "tinyexec": "^0.3.2", "uncrypto": "^0.1.3", "zod": "^3.25.56 || ^4.0.0", "zod-validation-error": "^5.0.0" } }, "sha512-wRD259+2Bxz78ULW733xb8V36DAUnA9hkj/zIkwMw6phf5hq1j/KHHT6xpSjiCzf5h/xloLhDxP8L7kyqSIAvw=="], - "@trigger.dev/sdk": ["@trigger.dev/sdk@4.7.6", "", { "dependencies": { "@opentelemetry/api": "1.9.1", "@opentelemetry/semantic-conventions": "1.41.1", "@trigger.dev/core": "4.7.6", "uncrypto": "^0.1.3" }, "peerDependencies": { "@ai-sdk/otel": ">=1.0.0-0 <2", "ai": "^5.0.0 || ^6.0.0 || >=7.0.0-canary <8", "react": "^18.0 || ^19.0", "zod": "^3.25.56 || ^4.0.0" }, "optionalPeers": ["@ai-sdk/otel", "ai", "react"] }, "sha512-PSHjW8w3HjxQTJye/4dUQbj7nUviZM6z5oplSWxKg9tXSgHSL15y1Rw7MejuevY5eqCqy3tm4aL97/OCXuyw0Q=="], + "@trigger.dev/sdk": ["@trigger.dev/sdk@4.8.2", "", { "dependencies": { "@opentelemetry/api": "1.9.1", "@opentelemetry/semantic-conventions": "1.41.1", "@trigger.dev/core": "4.8.2", "uncrypto": "^0.1.3" }, "peerDependencies": { "@ai-sdk/otel": ">=1.0.0-0 <2", "ai": "^5.0.0 || ^6.0.0 || >=7.0.0-canary <8", "react": "^18.0 || ^19.0", "zod": "^3.25.56 || ^4.0.0" }, "optionalPeers": ["@ai-sdk/otel", "ai", "react"] }, "sha512-IZD8+JfFQK4R7RdgYAeGiBohNfYJbB2I5ScdeUeR0ahLZl9yxXFRG5txByXAYk7FsEJcrvAUp1fq50OHTK0ylw=="], "@turbo/darwin-64": ["@turbo/darwin-64@2.9.14", "", { "os": "darwin", "cpu": "x64" }, "sha512-t7QiPflaEyBE4oayeZtSmu4mEfjgIrcNlNNl1z1dmIVPqEdtA7+CfTf8d7KXsOGPh6aNgWjKxyvQg9uGfDQF+A=="], @@ -5154,8 +5154,6 @@ "@trigger.dev/core/nanoid": ["nanoid@3.3.18", "", { "bin": { "nanoid": "bin/nanoid.cjs" } }, "sha512-DTg4MJbGMWkfi6VZFdNt2/caMbQy4Ou+Op/hJQvGEWcnVfoA1QA+xzRKAzw9jD6+GVOOeYr/mIcuDSdug6F6+w=="], - "@trigger.dev/core/socket.io-client": ["socket.io-client@4.7.5", "", { "dependencies": { "@socket.io/component-emitter": "~3.1.0", "debug": "~4.3.2", "engine.io-client": "~6.5.2", "socket.io-parser": "~4.2.4" } }, "sha512-sJ/tqHOCe7Z50JCBCXrsY3I2k03iOiUe+tj1OmKeD2lXPiGH/RUCdTZFoqVyN7l1MnpIzPrGtLcijffmeouNlQ=="], - "@trigger.dev/core/std-env": ["std-env@3.10.0", "", {}, "sha512-5GS12FdOZNliM5mAOxFRg7Ir0pWz8MdpYm6AY6VPkGpbA7ZzmbzNcBJQ0GPvvyWgcY7QAhCgf9Uy89I03faLkg=="], "@trigger.dev/core/tinyexec": ["tinyexec@0.3.2", "", {}, "sha512-KQQR9yN7R5+OSwaK0XQoj22pwHoTlgYqmUscPYoknOoWCWfj/5/ABTMRi69FrKU5ffPVh5QcFikpWJI/P1ocHA=="], @@ -5700,10 +5698,6 @@ "@trigger.dev/core/@opentelemetry/sdk-trace-node/@opentelemetry/context-async-hooks": ["@opentelemetry/context-async-hooks@2.8.0", "", { "peerDependencies": { "@opentelemetry/api": ">=1.0.0 <1.10.0" } }, "sha512-/3FIraneMcng67SUJCxvyInk/oxzwsxyadufk0wwfOBLf5wqtAGX4MoQASwSbndBPeARzBryUM9Azr5kHIdWLw=="], - "@trigger.dev/core/socket.io-client/debug": ["debug@4.3.7", "", { "dependencies": { "ms": "^2.1.3" } }, "sha512-Er2nc/H7RrMXZBFCEim6TCmMk02Z8vLC2Rbi1KEBggpo0fS6l0S1nnapwmIi3yW/+GOJap1Krg4w0Hg80oCqgQ=="], - - "@trigger.dev/core/socket.io-client/engine.io-client": ["engine.io-client@6.5.4", "", { "dependencies": { "@socket.io/component-emitter": "~3.1.0", "debug": "~4.3.1", "engine.io-parser": "~5.2.1", "ws": "~8.17.1", "xmlhttprequest-ssl": "~2.0.0" } }, "sha512-GeZeeRjpD2qf49cZQ0Wvh/8NJNfeXkXXcoGh+F77oEAgo9gUHwT1fCRxSNU+YEEaysOJTnsFHmM5oAcPy4ntvQ=="], - "@types/request/form-data/mime-types": ["mime-types@2.1.35", "", { "dependencies": { "mime-db": "1.52.0" } }, "sha512-ZDY+bPm5zTTF+YpCrAU9nK0UgICYPT0QtT1NZWFv4s++TNkcgVaT0g6+4R2uI4MjQjzysHB1zxuWL50hzaeXiw=="], "@types/ssh2/@types/node/undici-types": ["undici-types@5.26.5", "", {}, "sha512-JlCMO+ehdEIKqlFxk6IfVoAUVmgz7cU7zD/h9XZ0qzeosSHmUJVOzSQvvYSYWXkFXC+IfLKSIffhv0sVZup6pA=="], @@ -6074,8 +6068,6 @@ "@rolldown/binding-wasm32-wasi/@napi-rs/wasm-runtime/@tybys/wasm-util/tslib": ["tslib@2.8.1", "", {}, "sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w=="], - "@trigger.dev/core/socket.io-client/engine.io-client/xmlhttprequest-ssl": ["xmlhttprequest-ssl@2.0.0", "", {}, "sha512-QKxVRxiRACQcVuQEYFsI1hhkrMlrXHPegbbd1yn9UHOmRxY+si12nQYzri3vbzt8VdTTRviqcKxcyllFas5z2A=="], - "@types/request/form-data/mime-types/mime-db": ["mime-db@1.52.0", "", {}, "sha512-sPU4uV7dYlvtWJxwwxHD0PuihVNiE7TyAbQ5SWxDCB9mUYvOgroQOwYQQOKPJ8CIbE+1ETVlOoK1UC2nU3gYvg=="], "app-builder-lib/@electron/get/fs-extra/jsonfile": ["jsonfile@4.0.0", "", { "optionalDependencies": { "graceful-fs": "^4.1.6" } }, "sha512-m6F1R3z8jjlf2imQHS2Qez5sjKWQzbuuhuJ/FKYFRZvPE3PuHcSMVZzfsLhGVOkfd20obL5SWEBew5ShlquNxg=="], diff --git a/docker/app.Dockerfile b/docker/app.Dockerfile index 65e8395a667..1c280ef9161 100644 --- a/docker/app.Dockerfile +++ b/docker/app.Dockerfile @@ -7,7 +7,8 @@ FROM oven/bun:1.4.4-slim AS base # Node runs the isolated-vm sandbox worker and the Oracle Database worker (the # app itself runs under Bun); the version is kept in lockstep with the # `isolated-vm` pin in apps/sim/package.json — Node 24 (ABI 137) requires -# isolated-vm 6.x. +# isolated-vm 6.x — and with NODE_VERSION in apps/sim/trigger.config.ts, which +# copies the same Node into the Bun-based Trigger.dev task image. # # NODE_VERSION pins the exact NodeSource build: this layer is cached, so an # unpinned `nodejs` changed only when an unrelated edit forced a rebuild. The diff --git a/packages/security/src/tls-trust.ts b/packages/security/src/tls-trust.ts index 7e413634445..d97e53ca988 100644 --- a/packages/security/src/tls-trust.ts +++ b/packages/security/src/tls-trust.ts @@ -8,9 +8,9 @@ import tls from 'node:tls' * already excludes all four, so dropping them leaves the process trusting what * Firefox trusts. Upstream runtimes ship their own blocklists (Node.js #66871, * Bun #46159); once a deployed runtime has one, these roots are absent from its - * store and {@link distrustCompromisedRoots} changes nothing. The Bun services - * run a Bun that has it, so only the Trigger.dev task runtime, whose Node build - * the platform chooses, still calls this. + * store and {@link distrustCompromisedRoots} changes nothing. Every service now + * runs a Bun that has it; the Trigger.dev task runtime still calls this at + * start because the platform chooses that image's Bun build. */ const COMPROMISED_ROOT_SPKI_SHA256 = new Set([ '8d417db2dd8bf5e3084d1e3f196d583849d81bdd4c00c70b9d39369e96b8c782', // emSign ECC Root CA - G3