feat: recognize bun.lock as a dependency lock file

[YuniorGlez]

Description

Bun (https://bun.sh) is a JS/TS runtime and package manager whose lockfile bun.lock pins exact dependency versions — equivalent to package-lock.json or pnpm-lock.yaml. Repos using Bun were previously assessed as having no lock file (lock_files score 0) even though their dependencies are fully reproducible.

Type of Change

• New feature (non-breaking change which adds functionality)

Related Issues

No related issues (no existing Bun-support issue found; see sibling PRs #532, #533, #534).

Changes Made

• Add bun.lock to strict_lock_files in stub_assessors.py.
• Add unit test test_bun_lock_file covering a Bun-based repository.

Testing

• Unit tests pass (pytest) — 178 passed
• Manual testing performed — verified against a real Bun repo (Next.js base template, lock_files 0 → 100)
• No new warnings or errors — ruff clean

Checklist

• My code follows the project's code style
• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• My changes generate no new warnings
• I have added tests that prove my fix is effective or that my feature works
• New and existing unit tests pass locally with my changes
• Any dependent changes have been merged and published

Additional Notes

Part of a small series adding first-class Bun support to agentready (CI gates, single-file verification, dependency audit).

[coderabbitai]

📝 Walkthrough

Walkthrough

The dependency assessor now recognizes bun.lock as a strict lock file. A unit test verifies detection, full scoring, and lock-file evidence.

Changes

Dependency pinning

Layer / File(s)	Summary
Add Bun lock-file support src/agentready/assessors/stub_assessors.py, tests/unit/test_assessors_stub.py	DependencyPinningAssessor recognizes bun.lock. The test verifies successful detection, a 100-point score, and recorded evidence.

Possibly related PRs

• ambient-code/agentready#520: Refactors file discovery in the same assessor, but does not change lock-file detection.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Title check	⚠️ Warning	The title describes the main change but does not follow the required type(scope): description format because it omits a scope.	Add a scope, such as "feat(assessors): recognize bun.lock as a dependency lock file".

✅ Passed checks (4 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

✨ Simplify code

• Create PR with simplified code

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}