Resolve repository security findings

.github/workflows/quality.yml

@@ -2,23 +2,30 @@ name: ListingOS quality
 
 on:
   push:
-    branches: [main]
+    branches: [main, dev]
   pull_request:
+    branches: [main, dev]
+
+permissions:
+  contents: read
 
 jobs:
   validate:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          persist-credentials: false
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
-          node-version: 22
-          cache: npm
-      - run: npm ci
-      - run: npm run lint
-      - run: npm run typecheck
-      - run: npx expo-doctor
-      - run: npm run worker:check
-      - run: npx expo export --platform web
-      - run: npm run export:updates
+          bun-version-file: package.json
+      - run: bun install --frozen-lockfile
+      - run: bun run lint
+      - run: bun run typecheck
+      - run: bun run audit:high
+      - run: bun x expo-doctor
+      - run: bun run test:worker-security
+      - run: bun run worker:check
+      - run: bun x expo export --platform web
+      - run: bun run export:updates