From 37f301c5285aa28ef5a2ee3e13135f82aaf40758 Mon Sep 17 00:00:00 2001
From: Matt Carey <mcarey@cloudflare.com>
Date: Mon, 9 Mar 2026 15:54:31 +0000
Subject: [PATCH 1/2] fix: update bonk workflow to match vinext pattern

- Add author_association check (MEMBER/COLLABORATOR/OWNER only)
- Add opencode_dev: false and permissions: write
- Add bun setup and dependency install steps
- Fix concurrency group to include issue number
- Add fetch-depth: 30 for checkout
- Bump timeout to 30 minutes
- Downgrade checkout to v4 (matching vinext)
---
 .github/workflows/bonk.yml | 36 +++++++++++++++++++++++++++---------
 1 file changed, 27 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/bonk.yml b/.github/workflows/bonk.yml
index be5b01a..8087085 100644
--- a/.github/workflows/bonk.yml
+++ b/.github/workflows/bonk.yml
@@ -6,22 +6,38 @@ on:
   pull_request_review_comment:
     types: [created]
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.event.issue.number || github.ref }}
+  cancel-in-progress: false
+
 jobs:
   bonk:
-    if: github.event.sender.type != 'Bot' && (contains(github.event.comment.body, '/bonk') || contains(github.event.comment.body, '@ask-bonk'))
+    if: >-
+      github.event.sender.type != 'Bot' &&
+      (contains(github.event.comment.body, '/bonk') || contains(github.event.comment.body, '@ask-bonk')) &&
+      (
+        github.event.comment.author_association == 'MEMBER' ||
+        github.event.comment.author_association == 'COLLABORATOR' ||
+        github.event.comment.author_association == 'OWNER'
+      )
     runs-on: ubuntu-latest
-    timeout-minutes: 20
-    concurrency:
-      group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
-      cancel-in-progress: false
+    timeout-minutes: 30
     permissions:
       id-token: write
+      contents: write
       issues: write
       pull-requests: write
-      contents: write
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 30
+
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@v2
+
+      - name: Install dependencies
+        run: bun install --frozen-lockfile
 
       - name: Run Bonk
         uses: ask-bonk/ask-bonk/github@main
@@ -30,5 +46,7 @@ jobs:
           CLOUDFLARE_GATEWAY_ID: ${{ secrets.CF_AI_GATEWAY_NAME }}
           CLOUDFLARE_API_TOKEN: ${{ secrets.CF_AI_GATEWAY_TOKEN }}
         with:
-          model: 'cloudflare-ai-gateway/anthropic/claude-opus-4-6'
-          mentions: '/bonk,@ask-bonk'
+          model: "cloudflare-ai-gateway/anthropic/claude-opus-4-6"
+          mentions: "/bonk,@ask-bonk"
+          permissions: write
+          opencode_dev: false

From f6f4e8e9d704f097bc3c34774371d1cb08680e5d Mon Sep 17 00:00:00 2001
From: Matt Carey <mcarey@cloudflare.com>
Date: Mon, 9 Mar 2026 17:16:55 +0000
Subject: [PATCH 2/2] fix: use node/npm instead of bun for dependency install

---
 .github/workflows/bonk.yml | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/bonk.yml b/.github/workflows/bonk.yml
index 8087085..9b11964 100644
--- a/.github/workflows/bonk.yml
+++ b/.github/workflows/bonk.yml
@@ -33,11 +33,14 @@ jobs:
         with:
           fetch-depth: 30
 
-      - name: Setup Bun
-        uses: oven-sh/setup-bun@v2
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: npm
 
       - name: Install dependencies
-        run: bun install --frozen-lockfile
+        run: npm ci
 
       - name: Run Bonk
         uses: ask-bonk/ask-bonk/github@main