chore(trigger): run tasks on the bun-1.4 runtime

.github/workflows/ci.yml

@@ -287,7 +287,7 @@ jobs:
           if [ -n "$TRIGGER_BRANCH" ]; then
             TARGET_ARGS+=(--branch "$TRIGGER_BRANCH")
           fi
-          bunx trigger.dev@4.7.6 deploy "${TARGET_ARGS[@]}" --skip-promotion
+          bunx trigger.dev@4.8.2 deploy "${TARGET_ARGS[@]}" --skip-promotion
 
       - name: Validate deployment version output
         env:
@@ -638,7 +638,7 @@ jobs:
           if [ -n "$TRIGGER_BRANCH" ]; then
             TARGET_ARGS+=(--branch "$TRIGGER_BRANCH")
           fi
-          bunx trigger.dev@4.7.6 promote "$VERSION" "${TARGET_ARGS[@]}"
+          bunx trigger.dev@4.8.2 promote "$VERSION" "${TARGET_ARGS[@]}"
 
   # Production only, once the new app serves traffic: submit the library and comparison URLs this
   # push changed to IndexNow. Best effort: nothing depends on it, and a failure never fails the run.

.github/workflows/trigger-dev.yml

@@ -41,7 +41,7 @@ jobs:
           set -euo pipefail
           : "${TRIGGER_ACCESS_TOKEN:?TRIGGER_ACCESS_TOKEN_PREVIEW or TRIGGER_ACCESS_TOKEN must be configured}"
           : "${TRIGGER_PROJECT_ID:?TRIGGER_PROJECT_ID must be configured}"
-          bunx trigger.dev@4.7.6 deploy --env preview --branch dev-sim --skip-promotion
+          bunx trigger.dev@4.8.2 deploy --env preview --branch dev-sim --skip-promotion
 
       - name: Promote current dev preview
         working-directory: ./apps/sim
@@ -61,4 +61,4 @@ jobs:
             echo "::notice::Skipping superseded dev task version $VERSION"
             exit 0
           fi
-          bunx trigger.dev@4.7.6 promote "$VERSION" --env preview --branch dev-sim
+          bunx trigger.dev@4.8.2 promote "$VERSION" --env preview --branch dev-sim

apps/sim/package.json

@@ -174,8 +174,8 @@
     "@tiptap/starter-kit": "3.31.4",
     "@tiptap/suggestion": "3.31.4",
     "@tiptap/y-tiptap": "3.0.7",
-    "@trigger.dev/core": "4.7.6",
-    "@trigger.dev/sdk": "4.7.6",
+    "@trigger.dev/core": "4.8.2",
+    "@trigger.dev/sdk": "4.8.2",
     "@typescript/typescript6": "^6.0.2",
     "@xterm/addon-fit": "0.11.0",
     "@xterm/addon-unicode11": "0.9.0",
@@ -295,7 +295,7 @@
     "@tailwindcss/postcss": "^4.3.3",
     "@tailwindcss/typography": "0.5.20",
     "@testing-library/jest-dom": "^6.10.0",
-    "@trigger.dev/build": "4.7.6",
+    "@trigger.dev/build": "4.8.2",
     "@types/archiver": "8.0.0",
     "@types/busboy": "1.5.4",
     "@types/chrome": "0.3.6",

apps/sim/trigger.config.ts

@@ -4,6 +4,7 @@ import { OTLPTraceExporter } from '@opentelemetry/exporter-trace-otlp-http'
 import { resourceFromAttributes } from '@opentelemetry/resources'
 import { createLogger } from '@sim/logger'
 import { distrustCompromisedRoots } from '@sim/security/tls-trust'
+import type { BuildExtension } from '@trigger.dev/build'
 import {
   additionalFiles,
   additionalPackages,
@@ -65,6 +66,42 @@ function getFunctionExecutionEnvVars() {
   })
 }
 
+/**
+ * Node.js version copied into the task image, in lockstep with `NODE_VERSION`
+ * in `docker/app.Dockerfile`: `isolated-vm` 6.x loads its Node 24 (ABI 137)
+ * prebuild. The image is pinned by its multi-arch index digest.
+ */
+const NODE_VERSION = '24.22.1'
+const NODE_IMAGE = `node:${NODE_VERSION}-bookworm-slim@sha256:be8204d4bd327363357f532187b752ff62759c31bedf98e9e18fc08c9cbd605c`
+
+/**
+ * Tasks run on Bun, but the `bun-1.4` image ships no `node`, and the
+ * isolated-vm sandbox worker and the Oracle Database worker are spawned as
+ * `node` child processes, the same split as the app image. Adding image
+ * instructions also builds the install stage from this base, so `bun install`
+ * runs `isolated-vm`'s install script against the same Node. Deploy only:
+ * `trigger dev` spawns the developer's own `node`.
+ *
+ * @see https://trigger.dev/docs/guides/frameworks/bun#choosing-a-bun-runtime
+ */
+function nodeBinary(): BuildExtension {
+  return {
+    name: 'node-binary',
+    onBuildComplete(context) {
+      if (context.target === 'dev') return
+      context.addLayer({
+        id: 'node-binary',
+        image: {
+          instructions: [
+            `COPY --from=${NODE_IMAGE} /usr/local/bin/node /usr/local/bin/node`,
+            `RUN [ "$(node --version)" = "v${NODE_VERSION}" ]`,
+          ],
+        },
+      })
+    },
+  }
+}
+
 const grafanaTelemetry = grafanaFullyConfigured
   ? (() => {
       const baseUrl = grafanaEndpoint!.replace(/\/+$/, '')
@@ -88,7 +125,7 @@ const grafanaTelemetry = grafanaFullyConfigured
 
 export default defineConfig({
   project: env.TRIGGER_PROJECT_ID!,
-  runtime: 'node-24',
+  runtime: 'bun-1.4',
   logLevel: 'info',
   maxDuration: 5400,
   retries: {
@@ -159,6 +196,7 @@ export default defineConfig({
       'sharp',
     ],
     extensions: [
+      nodeBinary(),
       syncEnvVars(() => [
         { name: 'DB_APP_NAME', value: 'sim-trigger' },
         /**

docker/app.Dockerfile

@@ -7,7 +7,8 @@ FROM oven/bun:1.4.4-slim AS base
 # Node runs the isolated-vm sandbox worker and the Oracle Database worker (the
 # app itself runs under Bun); the version is kept in lockstep with the
 # `isolated-vm` pin in apps/sim/package.json — Node 24 (ABI 137) requires
-# isolated-vm 6.x.
+# isolated-vm 6.x — and with NODE_VERSION in apps/sim/trigger.config.ts, which
+# copies the same Node into the Bun-based Trigger.dev task image.
 #
 # NODE_VERSION pins the exact NodeSource build: this layer is cached, so an
 # unpinned `nodejs` changed only when an unrelated edit forced a rebuild. The

packages/security/src/tls-trust.ts

@@ -8,9 +8,9 @@ import tls from 'node:tls'
  * already excludes all four, so dropping them leaves the process trusting what
  * Firefox trusts. Upstream runtimes ship their own blocklists (Node.js #66871,
  * Bun #46159); once a deployed runtime has one, these roots are absent from its
- * store and {@link distrustCompromisedRoots} changes nothing. The Bun services
- * run a Bun that has it, so only the Trigger.dev task runtime, whose Node build
- * the platform chooses, still calls this.
+ * store and {@link distrustCompromisedRoots} changes nothing. Every service now
+ * runs a Bun that has it; the Trigger.dev task runtime still calls this at
+ * start because the platform chooses that image's Bun build.
  */
 const COMPROMISED_ROOT_SPKI_SHA256 = new Set([
   '8d417db2dd8bf5e3084d1e3f196d583849d81bdd4c00c70b9d39369e96b8c782', // emSign ECC Root CA - G3