ci: fix dependencies

docs/rules.md

@@ -12,7 +12,7 @@ Public API surface for Bun Bazel rules.
 Strict defaults:
 
 - `bun_build`, `bun_bundle`, `bun_compile`, and `bun_test` require `install_mode = "disable"`
-- Runtime launchers do not inherit the host `PATH` unless `inherit_host_path = True`
+- Runtime launchers stage hermetic `bun`, `bunx`, and `node` commands on `PATH` and do not inherit the host `PATH` unless `inherit_host_path = True`
 
 <a id="bun_binary"></a>
 
@@ -41,7 +41,7 @@ Use this rule for non-test scripts and CLIs that should run via `bazel run`.
 | <a id="bun_binary-entry_point"></a>entry_point |  Path to the main JS/TS file to execute.   | <a href="https://bazel.build/concepts/labels">Label</a> | required |  |
 | <a id="bun_binary-env_files"></a>env_files |  Additional environment files loaded with `--env-file`.   | <a href="https://bazel.build/concepts/labels">List of labels</a> | optional |  `[]`  |
 | <a id="bun_binary-install_mode"></a>install_mode |  Whether Bun may auto-install missing packages at runtime. Non-`disable` values are runtime opt-ins and are not hermetic.   | String | optional |  `"disable"`  |
-| <a id="bun_binary-inherit_host_path"></a>inherit_host_path |  If true, appends the host PATH after staged `node_modules/.bin` entries at runtime.   | Boolean | optional |  `False`  |
+| <a id="bun_binary-inherit_host_path"></a>inherit_host_path |  If true, appends the host PATH after the staged Bun runtime tool bin and `node_modules/.bin` entries at runtime.   | Boolean | optional |  `False`  |
 | <a id="bun_binary-no_env_file"></a>no_env_file |  If true, disables Bun's automatic `.env` loading.   | Boolean | optional |  `False`  |
 | <a id="bun_binary-node_modules"></a>node_modules |  Optional label providing package files from a `node_modules` tree, typically produced by `bun_install`, in runfiles.   | <a href="https://bazel.build/concepts/labels">Label</a> | optional |  `None`  |
 | <a id="bun_binary-preload"></a>preload |  Modules to preload with `--preload` before running the entry point.   | <a href="https://bazel.build/concepts/labels">List of labels</a> | optional |  `[]`  |
@@ -265,7 +265,7 @@ watch/HMR plus optional full restarts on selected file changes.
 | <a id="bun_dev-entry_point"></a>entry_point |  Path to the main JS/TS file to execute in dev mode.   | <a href="https://bazel.build/concepts/labels">Label</a> | required |  |
 | <a id="bun_dev-env_files"></a>env_files |  Additional environment files loaded with `--env-file`.   | <a href="https://bazel.build/concepts/labels">List of labels</a> | optional |  `[]`  |
 | <a id="bun_dev-install_mode"></a>install_mode |  Whether Bun may auto-install missing packages in dev mode. This is a local workflow helper, not a hermetic execution surface.   | String | optional |  `"disable"`  |
-| <a id="bun_dev-inherit_host_path"></a>inherit_host_path |  If true, appends the host PATH after staged `node_modules/.bin` entries at runtime.   | Boolean | optional |  `False`  |
+| <a id="bun_dev-inherit_host_path"></a>inherit_host_path |  If true, appends the host PATH after the staged Bun runtime tool bin and `node_modules/.bin` entries at runtime.   | Boolean | optional |  `False`  |
 | <a id="bun_dev-no_clear_screen"></a>no_clear_screen |  If true, disables terminal clearing on Bun reloads.   | Boolean | optional |  `False`  |
 | <a id="bun_dev-no_env_file"></a>no_env_file |  If true, disables Bun's automatic `.env` loading.   | Boolean | optional |  `False`  |
 | <a id="bun_dev-node_modules"></a>node_modules |  Optional label providing package files from a `node_modules` tree, typically produced by `bun_install`, in runfiles.   | <a href="https://bazel.build/concepts/labels">Label</a> | optional |  `None`  |
@@ -295,7 +295,7 @@ Use this rule to expose existing package scripts such as `dev`, `build`, or
 `check` via `bazel run` without adding wrapper shell scripts. This is a good fit
 for Vite-style workflows, where scripts like `vite dev` or `vite build` are
 declared in `package.json` and expect to run from the package directory with
-`node_modules/.bin` available on `PATH`.
+the staged Bun runtime tool bin and `node_modules/.bin` available on `PATH`.
 
 **ATTRIBUTES**
 
@@ -309,10 +309,10 @@ declared in `package.json` and expect to run from the package directory with
 | <a id="bun_script-execution_mode"></a>execution_mode |  How Bun should execute matching workspace scripts.   | String | optional |  `"single"`  |
 | <a id="bun_script-filters"></a>filters |  Workspace package filters passed via repeated `--filter` flags.   | List of strings | optional |  `[]`  |
 | <a id="bun_script-install_mode"></a>install_mode |  Whether Bun may auto-install missing packages while running the script. This is a local workflow helper, not a hermetic execution surface.   | String | optional |  `"disable"`  |
-| <a id="bun_script-inherit_host_path"></a>inherit_host_path |  If true, appends the host PATH after staged `node_modules/.bin` entries at runtime.   | Boolean | optional |  `False`  |
+| <a id="bun_script-inherit_host_path"></a>inherit_host_path |  If true, appends the host PATH after the staged Bun runtime tool bin and `node_modules/.bin` entries at runtime.   | Boolean | optional |  `False`  |
 | <a id="bun_script-no_env_file"></a>no_env_file |  If true, disables Bun's automatic `.env` loading.   | Boolean | optional |  `False`  |
 | <a id="bun_script-no_exit_on_error"></a>no_exit_on_error |  If true, Bun keeps running other workspace scripts when one fails.   | Boolean | optional |  `False`  |
-| <a id="bun_script-node_modules"></a>node_modules |  Optional label providing package files from a `node_modules` tree, typically produced by `bun_install`, in runfiles. Executables from `node_modules/.bin` are added to `PATH`, which is useful for scripts such as `vite`.   | <a href="https://bazel.build/concepts/labels">Label</a> | optional |  `None`  |
+| <a id="bun_script-node_modules"></a>node_modules |  Optional label providing package files from a `node_modules` tree, typically produced by `bun_install`, in runfiles. The staged Bun runtime tool bin and executables from `node_modules/.bin` are added to `PATH`, which is useful for scripts such as `vite`.   | <a href="https://bazel.build/concepts/labels">Label</a> | optional |  `None`  |
 | <a id="bun_script-package_json"></a>package_json |  Label of the `package.json` file containing the named script.   | <a href="https://bazel.build/concepts/labels">Label</a> | required |  |
 | <a id="bun_script-preload"></a>preload |  Modules to preload with `--preload` before running the script.   | <a href="https://bazel.build/concepts/labels">List of labels</a> | optional |  `[]`  |
 | <a id="bun_script-run_flags"></a>run_flags |  Additional raw flags forwarded to `bun run` before the script name.   | List of strings | optional |  `[]`  |
@@ -356,7 +356,7 @@ Supports Bazel test filtering (`--test_filter`) and coverage integration.
 | <a id="bun_test-coverage_reporters"></a>coverage_reporters |  Repeated Bun coverage reporters such as `text` or `lcov`.   | List of strings | optional |  `[]`  |
 | <a id="bun_test-env_files"></a>env_files |  Additional environment files loaded with `--env-file`.   | <a href="https://bazel.build/concepts/labels">List of labels</a> | optional |  `[]`  |
 | <a id="bun_test-install_mode"></a>install_mode |  Whether Bun may auto-install missing packages while testing. Hermetic tests require `\"disable\"`, and other values are rejected.   | String | optional |  `"disable"`  |
-| <a id="bun_test-inherit_host_path"></a>inherit_host_path |  If true, appends the host PATH after staged `node_modules/.bin` entries at runtime.   | Boolean | optional |  `False`  |
+| <a id="bun_test-inherit_host_path"></a>inherit_host_path |  If true, appends the host PATH after the staged Bun runtime tool bin and `node_modules/.bin` entries at runtime.   | Boolean | optional |  `False`  |
 | <a id="bun_test-max_concurrency"></a>max_concurrency |  Optional maximum number of concurrent tests.   | Integer | optional |  `0`  |
 | <a id="bun_test-no_env_file"></a>no_env_file |  If true, disables Bun's automatic `.env` loading.   | Boolean | optional |  `False`  |
 | <a id="bun_test-node_modules"></a>node_modules |  Optional label providing package files from a `node_modules` tree, typically produced by `bun_install`, in runfiles.   | <a href="https://bazel.build/concepts/labels">Label</a> | optional |  `None`  |
@@ -427,7 +427,7 @@ the provided tool with any default arguments.
 | <a id="js_run_devserver-package_dir_hint"></a>package_dir_hint |  Optional package-relative directory hint when package_json is not supplied.   | String | optional |  `"."`  |
 | <a id="js_run_devserver-package_json"></a>package_json |  Optional package.json used to resolve the package working directory.   | <a href="https://bazel.build/concepts/labels">Label</a> | optional |  `None`  |
 | <a id="js_run_devserver-tool"></a>tool |  Executable target to launch as the dev server.   | <a href="https://bazel.build/concepts/labels">Label</a> | required |  |
-| <a id="js_run_devserver-inherit_host_path"></a>inherit_host_path |  If true, appends the host PATH after staged `node_modules/.bin` entries at runtime.   | Boolean | optional |  `False`  |
+| <a id="js_run_devserver-inherit_host_path"></a>inherit_host_path |  If true, appends the host PATH after the staged Bun runtime tool bin and `node_modules/.bin` entries at runtime.   | Boolean | optional |  `False`  |
 | <a id="js_run_devserver-working_dir"></a>working_dir |  Working directory at runtime: Bazel runfiles workspace root or the resolved package directory.   | String | optional |  `"workspace"`  |