fix: restore nightly provenance updater

[jan-kubica]

Summary

• pin nightly provenance updates to the shared workflow commit that installs Bun before running repository install commands
• pick up the shared provenance updater default bump to v0.1.3

Root cause

The shared nightly updater ran the repository install command but did not install Bun, so Bun-based repos failed before provenance generation with bun: command not found.

---

[greptile-apps]

Greptile Summary

This PR fixes the nightly provenance updater for Bun-based repos by pinning the shared reusable workflow to commit cbcba03b6492bbc8a29da0bf2416b01431c4d90a, which installs Bun before running the repository install command. It also bumps provenance-version to v0.1.3, exempts internal platform packages from the 5-day release-age quarantine in bunfig.toml, and refreshes the generated provenance artifacts (SBOM, notices, report).

Confidence Score: 5/5

Safe to merge — targeted CI infrastructure fix with no production code changes.

All changes are CI workflow, configuration, and auto-generated provenance artifacts. The workflow is pinned to a specific immutable commit SHA (good supply chain hygiene), uses frozen lockfile, and the bunfig.toml quarantine exclusions are scoped only to the project's own platform packages. No logic bugs or security concerns found.

No files require special attention.

Important Files Changed

Filename	Overview
.github/workflows/provenance-nightly.yml	Pins shared provenance-update workflow to commit cbcba03b6492bbc8a29da0bf2416b01431c4d90a (which installs Bun) and bumps provenance-version to v0.1.3.
bunfig.toml	Adds minimumReleaseAgeExcludes entries for the project's own internal Bun platform packages, allowing the nightly workflow to pick up fresh releases without the 5-day quarantine delay.
provenance/sbom.cdx.json	Auto-generated CycloneDX SBOM refreshed by the nightly provenance workflow; contains updated Rust and JS dependency inventory.
provenance/THIRD-PARTY-NOTICES.txt	Auto-generated third-party license notice file, refreshed alongside the SBOM.
provenance/report.json	Auto-generated provenance report showing 43 detected dependencies across JavaScript and Rust ecosystems; no meaningful manual changes.
bun.lock	Lockfile updated to reflect dependency state used by the refreshed provenance run.

Sequence Diagram

sequenceDiagram
    participant Cron as Cron (02:00 UTC)
    participant NightlyWF as provenance-nightly.yml
    participant SharedWF as stella/.github provenance-update.yml@cbcba03
    participant BunInstall as Install Bun step
    participant RepoInstall as bun install --frozen-lockfile
    participant Provenance as Provenance Tool (v0.1.3)
    participant PR as GitHub PR

    Cron->>NightlyWF: trigger
    NightlyWF->>SharedWF: uses (pinned SHA) with install-command & provenance-version
    SharedWF->>BunInstall: install Bun runtime
    BunInstall-->>SharedWF: Bun ready
    SharedWF->>RepoInstall: run bun install --frozen-lockfile
    RepoInstall-->>SharedWF: deps installed
    SharedWF->>Provenance: run provenance v0.1.3 (generate SBOM, notices, report)
    Provenance-->>SharedWF: artifacts updated
    SharedWF->>PR: open/update PR with provenance artifacts

Loading

_{Reviews (3): Last reviewed commit: "chore: retrigger CI for nightly provenan..." | Re-trigger Greptile}