From e1114bc14579c150241425f18c9df180edaf0236 Mon Sep 17 00:00:00 2001 From: pat-s Date: Fri, 4 Sep 2026 19:26:55 +0000 Subject: [PATCH] fix(ci): give the index writers the metadata database password (#201) ## Why Pipeline 12207 logs one of these per slot: ``` Error: connection to server at "r-binaries.devxy.io" (116.203.165.191), port 15432 failed: fe_sendauth: no password supplied ``` bincraft's index build calls `abi_cache_risky_packages()` to decide which packages may be carried from the flat slot into a per-minor index. `reindex.yaml` and `weekly-rebuild-reindex.yaml` never passed `PGPASS`, so the query cannot connect. It fails soft by design, which is what makes this worth fixing rather than tolerating: the run still reports **success** while using an empty cache-derived risky set. The index is then written as though no package were known risky from the classifier, which is the exact state the cache was added to fix. `build-all-versions.yaml` already passes `PGPASS`, which is why classification behaved correctly there and silently degraded here. ## What changed Adds the `PGPASS` secret to both index-writing workflows, with a comment explaining why its absence is invisible rather than loud. `crow lint` passes on both files. ## Note The tarball-derived half of the risky set still worked, so indexes written without this are not wrong so much as incomplete: they miss packages that are known risky from classification but have no per-minor tarball yet. A re-index after this merges applies the full set. Reviewed-on: https://git.devxy.io/devxy/build-cran-binaries/pulls/201 --- .crow/reindex.yaml | 7 +++++++ .crow/weekly-rebuild-reindex.yaml | 7 +++++++ 2 files changed, 14 insertions(+) diff --git a/.crow/reindex.yaml b/.crow/reindex.yaml index b13245a..528def4 100644 --- a/.crow/reindex.yaml +++ b/.crow/reindex.yaml @@ -142,6 +142,13 @@ steps: from_secret: B2_S3_ACCESS_KEY B2_S3_SECRET_KEY: from_secret: B2_S3_SECRET_KEY + # The index build reads the ABI classifier cache to decide which packages + # may be carried from the flat slot into a per-minor one. Without the + # password that query fails, and it fails soft, so the run still succeeds + # while quietly using an empty risky set: exactly the state the cache was + # added to fix. It logs one connection error per slot. + PGPASS: + from_secret: PGPASS REPO_RO_TOKEN: from_secret: REPO_RO_TOKEN GIT_USER: pat-s diff --git a/.crow/weekly-rebuild-reindex.yaml b/.crow/weekly-rebuild-reindex.yaml index c9f9a8a..8de71f7 100644 --- a/.crow/weekly-rebuild-reindex.yaml +++ b/.crow/weekly-rebuild-reindex.yaml @@ -145,6 +145,13 @@ steps: from_secret: B2_S3_ACCESS_KEY B2_S3_SECRET_KEY: from_secret: B2_S3_SECRET_KEY + # The index build reads the ABI classifier cache to decide which packages + # may be carried from the flat slot into a per-minor one. Without the + # password that query fails, and it fails soft, so the run still succeeds + # while quietly using an empty risky set: exactly the state the cache was + # added to fix. It logs one connection error per slot. + PGPASS: + from_secret: PGPASS REPO_RO_TOKEN: from_secret: REPO_RO_TOKEN GIT_USER: pat-s