feat: recognize bun.lock as a dependency lock file

[YuniorGlez]

Description

Bun (https://bun.sh) is a JS/TS runtime and package manager whose lockfile bun.lock pins exact dependency versions — equivalent to package-lock.json or pnpm-lock.yaml. Repos using Bun were previously assessed as having no lock file (lock_files score 0) even though their dependencies are fully reproducible.

Type of Change

• New feature (non-breaking change which adds functionality)

Related Issues

No related issues (no existing Bun-support issue found; see sibling PRs #532, #533, #534).

Changes Made

• Add bun.lock to strict_lock_files in stub_assessors.py.
• Add unit test test_bun_lock_file covering a Bun-based repository.

Testing

• Unit tests pass (pytest) — 178 passed
• Manual testing performed — verified against a real Bun repo (Next.js base template, lock_files 0 → 100)
• No new warnings or errors — ruff clean

Checklist

• My code follows the project's code style
• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• My changes generate no new warnings
• I have added tests that prove my fix is effective or that my feature works
• New and existing unit tests pass locally with my changes
• Any dependent changes have been merged and published

Additional Notes

Part of a small series adding first-class Bun support to agentready (CI gates, single-file verification, dependency audit).

[coderabbitai]

📝 Walkthrough

Walkthrough

The dependency assessor now recognizes bun.lock as a strict lock file. A unit test verifies detection, full scoring, and lock-file evidence.

Changes

Dependency pinning

Layer / File(s)	Summary
Add Bun lock-file support src/agentready/assessors/stub_assessors.py, tests/unit/test_assessors_stub.py	DependencyPinningAssessor recognizes bun.lock. The test verifies successful detection, a 100-point score, and recorded evidence.

Possibly related PRs

• ambient-code/agentready#520: Refactors file discovery in the same assessor, but does not change lock-file detection.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Title check	⚠️ Warning	The title describes the main change but does not follow the required type(scope): description format because it omits a scope.	Add a scope, such as "feat(assessors): recognize bun.lock as a dependency lock file".

✅ Passed checks (4 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

✨ Simplify code

• Create PR with simplified code

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

📈 Test Coverage Report

Branch	Coverage
This PR	76.2%
Main	76.2%
Diff	✅ +0%

---

Coverage calculated from unit tests only

[jwm4]

Thanks for this contribution! I checked out the branch and tested it against real repositories, and the change works as advertised:

• thisuxhq/sveltednd (has bun.lock): lock_files now passes at 100 with evidence "Found lock file(s): bun.lock"
• nensii21/devlink (has package-lock.json): still passes at 100, so no regression
• jbilcke-hf/clapper (has only bun.lockb): still fails with "No dependency lock files found"

Two requests before merging:

1. Please update docs/attributes.md. The auto-managed lock file list (around line 512) needs bun.lock added. Our convention (AGENTS.md, guideline 7) is that any change to an assessor's recognized paths updates that doc in the same PR.

2. Consider also adding bun.lockb. That was Bun's default lockfile format before Bun 1.2, and many Bun repos still only have the binary lockfile (clapper above is an example, and it scores 0 on this attribute today despite having a fully pinned, auto-managed lockfile). Since the strict list is a filename existence check, this would be a one-line addition. If you'd rather keep this PR minimal, I'm fine deferring it to a follow-up, just let me know which way you want to go.

The code change itself looks good and the unit test is appreciated. Happy to merge once the docs are synced.

This comment is from Bill Murdock, written with assistance from Claude Code.