fix(ci): pass the metadata DB to per-minor reindexes and fail on errors (#234)

Step 1 of rpkgs/bincraft#211: pass the metadata database explicitly so bincraft can drop its implicit production defaults.

## Changes

- Pass `metadata_db_*` explicitly to every per-minor `upload_package_index()` call in `reindex.yaml`, `process-updates.yaml`, `weekly-rebuild-reindex.yaml`, `build-all-versions.yaml` and `prune-stale-flat-binaries.yaml`.
- Replace `|| true` in those per-minor loops with a list of failed minors: every minor is still attempted, then the step exits 1 naming the ones that failed.
- Give the "Upload package indexes" step of `build-all-versions.yaml` the `PGPASS` secret. It never had it, so its per-minor reindexes always aborted and `|| true` hid that.
- Run the CDN purge in `process-updates.yaml` and `prune-stale-flat-binaries.yaml` even when a reindex failed, as `reindex.yaml` and `weekly-rebuild-reindex.yaml` already do, because the generic index was still replaced.
- `local/repair-built-stamp.R` passes the database too, and fails once all minors are tried instead of only printing the error.

The generic (non-per-minor) calls are unchanged: they never read the database.

## Behaviour change

A per-minor reindex that fails now turns the pipeline red instead of passing silently.
Expect build-all-versions runs to start reindexing per-minor slots for real, since they now have the password.

## Ordering

Merge this before rpkgs/bincraft's companion PR is released: `local/install-bincraft.R` installs the latest bincraft tag, and the explicit arguments work with both the current and the next release.

Reviewed-on: #234

local/repair-built-stamp.R

@@ -152,18 +152,44 @@ bincraft::upload_package_index(
   s3_access_key_id = Sys.getenv("B2_S3_ACCESS_KEY"),
   s3_secret_access_key = Sys.getenv("B2_S3_SECRET_KEY")
 )
+# A per-minor index reads the ABI classifier cache and the flat-object safety
+# table from the build database. A failed minor does not stop the others, but
+# it does fail the run once they are done.
+failed_minors <- character(0L)
 for (minor in r_minors) {
-  try(
-    bincraft::upload_package_index(
-      codename = codename,
-      r_minor = minor,
-      s3_endpoint = endpoint,
-      s3_region = region,
-      s3_bucket = bucket,
-      s3_access_key_id = Sys.getenv("B2_S3_ACCESS_KEY"),
-      s3_secret_access_key = Sys.getenv("B2_S3_SECRET_KEY")
-    ),
-    silent = FALSE
+  ok <- tryCatch(
+    {
+      bincraft::upload_package_index(
+        codename = codename,
+        r_minor = minor,
+        s3_endpoint = endpoint,
+        s3_region = region,
+        s3_bucket = bucket,
+        s3_access_key_id = Sys.getenv("B2_S3_ACCESS_KEY"),
+        s3_secret_access_key = Sys.getenv("B2_S3_SECRET_KEY"),
+        metadata_db_host = "r-binaries.devxy.io",
+        metadata_db_name = "build_metadata",
+        metadata_db_port = 15432L,
+        metadata_db_user = "rpkgs",
+        metadata_db_password = Sys.getenv("PGPASS"),
+        metadata_db_sslmode = "verify-full"
+      )
+      TRUE
+    },
+    error = function(e) {
+      message(sprintf("Re-indexing %s failed: %s", minor, conditionMessage(e)))
+      FALSE
+    }
+  )
+  if (!ok) {
+    failed_minors <- c(failed_minors, minor)
+  }
+}
+if (length(failed_minors) > 0L) {
+  stop(
+    "Could not republish the per-minor index for: ",
+    paste(failed_minors, collapse = ", "),
+    call. = FALSE
   )
 }