fix(ci): avoid piping Bun installer into shell

.gitlab-ci.yml

@@ -10,7 +10,12 @@ variables:
 
 .setup-bun: &setup-bun
   - apt-get update -qq && apt-get install -qq -y curl jq git
-  - curl -fsSL https://bun.sh/install | bash -s "bun-v$BUN_VERSION"
+  - |
+    BUN_INSTALL_SCRIPT="$(mktemp)"
+    trap 'rm -f "$BUN_INSTALL_SCRIPT"' EXIT
+    curl -fsSL https://bun.sh/install -o "$BUN_INSTALL_SCRIPT"
+    test -s "$BUN_INSTALL_SCRIPT"
+    bash "$BUN_INSTALL_SCRIPT" "bun-v$BUN_VERSION"
   - export PATH="$HOME/.bun/bin:$PATH"
 
 version-gate:

test/gitlab-ci-safety.test.ts

@@ -0,0 +1,18 @@
+import { describe, expect, test } from 'bun:test';
+import { readFileSync } from 'fs';
+import { join } from 'path';
+
+const ROOT = join(import.meta.dir, '..');
+
+describe('GitLab CI installer safety', () => {
+  test('does not pipe the remote Bun installer directly into a shell', () => {
+    const ci = readFileSync(join(ROOT, '.gitlab-ci.yml'), 'utf-8');
+    const offenders = ci
+      .split('\n')
+      .map((line, index) => ({ line: index + 1, text: line.trim() }))
+      .filter(({ text }) => /bun\.sh\/install/.test(text))
+      .filter(({ text }) => /\bcurl\b.*\|\s*(bash|sh)\b/.test(text));
+
+    expect(offenders).toEqual([]);
+  });
+});