devxy/build-cran-binaries
Watch
1
0
Fork
You've already forked build-cran-binaries
 0
Code Issues 10 Pull requests Releases Activity

fix(local): accept TF_VAR_-prefixed B2 keys, optional GITHUB_PAT (#88)
Some checks failed
ci/crow/cron/process-updates-redhat-10-amd64 Pipeline was successful
Details
ci/crow/cron/process-updates-redhat-10-arm64 Pipeline failed
Details
ci/crow/cron/process-updates-ubuntu-2404-arm64 Pipeline failed
Details
ci/crow/cron/process-updates-ubuntu-2404-amd64 Pipeline was successful
Details

Browse source 
## Summary

Follow-up fix to the `just rebuild` recipe (#87): the local `.envrc` exports the B2 credentials as `TF_VAR_B2_S3_ACCESS_KEY` / `TF_VAR_B2_S3_SECRET_KEY` (and has no `GITHUB_PAT`), but the recipe required the plain `B2_S3_ACCESS_KEY` / `B2_S3_SECRET_KEY` names and always passed a `github_pat` secret.

- Accept the `TF_VAR_`-prefixed B2 names (falling back to the plain names if set directly).
- Pass the `github_pat` buildx secret only when `GITHUB_PAT` is set, so the build works without it.

Reviewed-on: #88
This commit is contained in:
Patrick Schratz 2026-06-14 09:08:48 +00:00 • committed by Patrick Schratz
commit 7f5674ffb3
1 changed files with 16 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

24
justfile
View file

@ -38,20 +38,28 @@ rebuild os tag arch package *versions:
arm64) builder="{{ arm64_builder }}" ;;
*) echo "error: arch must be 'amd64' or 'arm64'" >&2; exit 1 ;;
esac
: "${B2_S3_ACCESS_KEY:?set B2_S3_ACCESS_KEY in your environment}"
: "${B2_S3_SECRET_KEY:?set B2_S3_SECRET_KEY in your environment}"
: "${PGPASS:?set PGPASS in your environment}"
: "${GITHUB_PAT:=}"
# Accept TF_VAR_-prefixed names (direnv) or plain names.
export B2_S3_ACCESS_KEY="${B2_S3_ACCESS_KEY:-${TF_VAR_B2_S3_ACCESS_KEY:-}}"
export B2_S3_SECRET_KEY="${B2_S3_SECRET_KEY:-${TF_VAR_B2_S3_SECRET_KEY:-}}"
: "${B2_S3_ACCESS_KEY:?set B2_S3_ACCESS_KEY or TF_VAR_B2_S3_ACCESS_KEY}"
: "${B2_S3_SECRET_KEY:?set B2_S3_SECRET_KEY or TF_VAR_B2_S3_SECRET_KEY}"
: "${PGPASS:?set PGPASS}"
secret_args=(
--secret id=b2_access,env=B2_S3_ACCESS_KEY
--secret id=b2_secret,env=B2_S3_SECRET_KEY
--secret id=pgpass,env=PGPASS
)
# GITHUB_PAT is optional (raises the GitHub API rate limit); pass only if set.
if [ -n "${GITHUB_PAT:-}" ]; then
secret_args+=(--secret id=github_pat,env=GITHUB_PAT)
fi
echo "Dispatching build of {{ package }} ({{ versions }}) on {{ os }}:{{ tag }}/{{ arch }} (R {{ r_version }}) to builder '$builder'"
docker buildx build \
--builder "$builder" \
--platform "linux/{{ arch }}" \
--no-cache \
--output type=cacheonly \
--secret id=b2_access,env=B2_S3_ACCESS_KEY \
--secret id=b2_secret,env=B2_S3_SECRET_KEY \
--secret id=pgpass,env=PGPASS \
--secret id=github_pat,env=GITHUB_PAT \
"${secret_args[@]}" \
--build-arg OS="{{ os }}" \
--build-arg OS_VERSION="{{ tag }}" \
--build-arg R_VERSION="{{ r_version }}" \