refactor: replace bun run with tsx/pnpm across scripts and CI

[BYK]

Phase 4: Replace bun run with tsx/pnpm run

Part of the Bun → Node.js migration. Removes Bun as the TypeScript runner for scripts and CI, replacing with tsx and pnpm run.

Changes

Script files (14 converted):

• Replaced Bun.file().text() → readFile() from node:fs/promises
• Replaced Bun.write() → writeFile()
• Replaced Bun.file().exists() → access()
• Replaced Bun.file().json() → JSON.parse(readFile())
• Replaced new Bun.Glob() → tinyglobby
• Updated shebangs: #!/usr/bin/env bun → #!/usr/bin/env tsx
• generate-api-schema.ts: replaced require.resolve("@sentry/api/package.json") with import.meta.resolve + fileURLToPath (avoids ERR_PACKAGE_PATH_NOT_EXPORTED and ERR_AMBIGUOUS_MODULE_SYNTAX)

ESM require shim (script/require-shim.mjs):

• Source code uses bare require() for lazy loading (circular dep breaking, optional features). This works natively in Bun and CJS bundles, but fails under tsx/Node ESM (since "type": "module" is set).
• The shim provides globalThis.require via createRequire, anchored at the project root (package.json).
• All relative require() calls in src/ are behind runtime-only code paths (DB init, telemetry) that do not execute during tsx script runs.

Worker source refactor (src/lib/scan/grep-worker-source.ts):

• Replaced import ... with { type: "text" } (Bun-specific) with a wrapper module that uses readFileSync at dev time.
• At build time, esbuild's text-import-plugin intercepts the module and inlines grep-worker.js as a string constant.
• Removed the now-dead textImportPlugin from vitest.config.ts.

package.json:

• Added "tsx" script alias: tsx --import ./script/require-shim.mjs
• All scripts use pnpm tsx (which invokes the alias)
• Only build/build:all retain bun run (needs Bun.build() compiler)

CI (.github/workflows/ci.yml):

• Removed setup-bun from all jobs except build-binary
• All bun run → pnpm run in non-build steps

Documentation:

• Updated README.md, DEVELOPMENT.md, contributing.md to use pnpm run instead of bun run
• Updated script JSDoc usage examples in bench.ts, bench-sweep.ts
• Added docs/pnpm-lock.yaml for docs site build (was using bun.lock)

Tests:

• Fixed bundle.test.ts and library.test.ts E2E tests: spawn("bun", ...) → spawn("pnpm", ...)
• Fixed concurrent-worker.ts shebang and usage comments

Intentionally kept on Bun

• script/build.ts — uses Bun.build() (compiler) which has no Node equivalent
• build-binary CI job retains setup-bun

Testing

• All CI checks pass (lint, typecheck, unit tests, E2E, build binary, build npm, build docs)
• tsx confirmed working on Node v22 and v24

[cursor]

Cursor Bugbot has reviewed your changes and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 45bbbf6. Configure here.}

[github-actions]

PR Preview Action v1.8.1
🚀 View preview at https://cli.sentry.dev/_preview/pr-999/
Built to branch gh-pages at 2026-05-21 22:23 UTC. Preview will be ready when the GitHub Pages deployment is complete.

[github-actions]

Codecov Results 📊

✅ Patch coverage is 100.00%. Project has 4286 uncovered lines.
✅ Project coverage is 81.64%. Comparing base (base) to head (head).

Coverage diff

@@            Coverage Diff             @@
##          main       #PR       +/-##
==========================================
+ Coverage    81.64%    81.64%        —%
==========================================
  Files          328       328         —
  Lines        23344     23343        -1
  Branches     15111     15111         —
==========================================
+ Hits         19058     19057        -1
- Misses        4286      4286         —
- Partials      1613      1613         —

---

Generated by Codecov Action