ci: retry spec fetch with backoff, move dependabot to the bun ecosystem

- generate.ts: a transient CDN 520 failed the 2026-07-07 scheduled release run; retry up to 5 times with exponential backoff
- dependabot: npm ecosystem bumps only touch package.json and leave bun.lock stale, so the frozen-lockfile CI gate rejected every dependabot PR; the bun ecosystem updates both. Groups switch to a catch-all pattern since bun lacks dependency-type grouping.

Author: ph33nx

.github/dependabot.yml

@@ -1,6 +1,9 @@
 version: 2
 updates:
-  - package-ecosystem: npm
+  # bun ecosystem (not npm): the repo lockfile is bun.lock, and npm-ecosystem
+  # bumps touch only package.json, so CI's frozen-lockfile install rejects
+  # every dependabot PR.
+  - package-ecosystem: bun
     directory: /
     schedule:
       interval: weekly
@@ -9,9 +12,11 @@ updates:
     # a chance to be flagged for supply-chain issues before they land.
     cooldown:
       default-days: 3
+    # bun does not support dependency-type grouping; every dep here is a
+    # devDependency, so a catch-all pattern is equivalent.
     groups:
       dev-dependencies:
-        dependency-type: development
+        patterns: ["*"]
     # hey-api is the pinned code generator and its paired runtime client.
     # Bumps change generated output and break the codegen drift check, so
     # they are upgraded deliberately at release time, never by dependabot.

scripts/generate.ts

@@ -9,11 +9,29 @@ import { mkdirSync, writeFileSync } from 'node:fs';
 const SPEC_URL = 'https://roxyapi.com/api/v2/openapi.json';
 const SPEC_PATH = 'specs/openapi.json';
 
-console.log('Fetching OpenAPI spec from', SPEC_URL);
-const res = await fetch(SPEC_URL, { headers: { 'Cache-Control': 'no-cache' } });
-if (!res.ok) throw new Error(`Fetch failed: ${res.status} ${res.statusText}`);
+/** Retry with exponential backoff: a transient upstream error (e.g. a CDN 520) must not fail the daily release run. */
+async function fetchSpec(url: string, attempts = 5): Promise<string> {
+	for (let attempt = 1; ; attempt++) {
+		try {
+			const res = await fetch(url, {
+				headers: { 'Cache-Control': 'no-cache' },
+			});
+			if (!res.ok)
+				throw new Error(`Fetch failed: ${res.status} ${res.statusText}`);
+			return await res.text();
+		} catch (err) {
+			if (attempt === attempts) throw err;
+			const delay = 2 ** attempt;
+			console.warn(
+				`Attempt ${attempt}/${attempts} failed (${err instanceof Error ? err.message : err}), retrying in ${delay}s`,
+			);
+			await new Promise((resolve) => setTimeout(resolve, delay * 1000));
+		}
+	}
+}
 
-const spec = JSON.parse(await res.text());
+console.log('Fetching OpenAPI spec from', SPEC_URL);
+const spec = JSON.parse(await fetchSpec(SPEC_URL));
 
 // Patch server URL to absolute production URL so the generated default client
 // works out of the box without users specifying baseUrl