Adds audit_bun_lockfile() that parses Bun's text lockfile format
(bun.lock, lockfileVersion 1) and applies the same supply-chain
checks already used on npm and cargo lockfiles:
- non-registry-resolved-url (git+/file:/tarball sources)
- missing-integrity-hash (no sha-prefixed tail on registry entry)
- blocked-known-malicious (BLOCKED_NPM_VERSIONS hit)
- known-ioc-string (IOC substring in raw body)
- missing-lockfile (path doesn't exist)
- unreadable-lockfile (chmod 000 / OSError)
- malformed-lockfile (JSONC parse failure)
- unsupported-lockfile-version (anything != 1)
bun.lock is JSONC (valid JSON with trailing commas allowed); the
parser strips trailing commas via a single regex before json.loads.
Each package entry is a 4-element array:
["name@version", "<registry-url-or-empty>", {metadata}, "sha512-..."]
Default scope adds the three bun.lock paths committed alongside
the three package-lock.json paths. New repeatable --bun-lockfile
flag mirrors --npm-lockfile and --cargo-lockfile.
Verified locally:
positive (3 npm + 3 bun + 1 cargo, real PR lockfiles): exit 0
unreadable bun.lock (chmod 000): exit 1, [unreadable-lockfile]
malformed bun.lock: exit 1, [malformed-lockfile]
missing bun.lock: exit 1, [missing-lockfile]
819ed20e98