From f3984f337d4e4e10a7e8c49a1d8bc9eb9683ff1c Mon Sep 17 00:00:00 2001 From: pat-s Date: Sat, 5 Sep 2026 15:59:16 +0000 Subject: [PATCH] fix(ci): authenticate uvr's GitHub resolution in the index workflows (#204) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## Why The post-backfill re-index (12257) reported failure. Five slots could not write their indexes: ``` WARN Failed to fetch git Remote pat-s/cranlike@s3 (GitHub API error: 403 Forbidden); falling back to registry resolution ! Attempt 1/3 to update PACKAGES failed (unused argument (built = built)). Retrying in 5s... Error: Failed to update PACKAGES after 3 attempts. Last error: unused argument (built = built) ``` uvr resolves bincraft's dependencies through the GitHub API, including the `pat-s/cranlike@s3` fork. Unauthenticated, that is rate limited. uvr does not fail on the 403 — it **warns and falls back to the registry copy of cranlike**, which has no `built` parameter, so `update_PACKAGES(built = ...)` dies three retries later. Affected: alpine323, rhel8, rhel9, rhel10, noble. The remaining 13 slots resolved the fork fine and indexed correctly, which is what makes this insidious: the same pipeline passes or fails on identical input depending on the rate-limit window. `build-all-versions.yaml` and `rebuild-abi-gap.yaml` already pass `GITHUB_PAT`, which is why they were never affected. ## What changed Adds the `GITHUB_PAT` secret to `reindex.yaml`, `weekly-rebuild-reindex.yaml` and `backfill-flat-safety.yaml`, with a comment recording why its absence is quiet rather than loud. `crow lint` passes on all three. ## Context The re-index itself did what it was meant to. Drops per per-minor index fell from ~1800-2200 to: ``` 4.4: avg 129 4.5: avg 172 4.6: avg 145 ``` so the per-object safety verdicts recovered roughly 93% of the coverage while still dropping every object that genuinely cannot load. This PR is about the five slots that never got to apply it. Reviewed-on: https://git.devxy.io/devxy/build-cran-binaries/pulls/204 --- .crow/backfill-flat-safety.yaml | 8 ++++++++ .crow/reindex.yaml | 8 ++++++++ .crow/weekly-rebuild-reindex.yaml | 8 ++++++++ 3 files changed, 24 insertions(+) diff --git a/.crow/backfill-flat-safety.yaml b/.crow/backfill-flat-safety.yaml index e2f850d..e5c9b68 100644 --- a/.crow/backfill-flat-safety.yaml +++ b/.crow/backfill-flat-safety.yaml @@ -150,6 +150,14 @@ steps: from_secret: PGPASS REPO_RO_TOKEN: from_secret: REPO_RO_TOKEN + # uvr resolves bincraft's dependencies through the GitHub API, including + # the pat-s/cranlike@s3 fork. Unauthenticated it is rate limited, and the + # failure is not loud: uvr warns, falls back to the registry copy of + # cranlike, and the index write then dies on `unused argument (built = + # built)` because upstream has no such parameter. Intermittent by nature, + # since it depends on the rate-limit window. + GITHUB_PAT: + from_secret: GITHUB_PAT GIT_USER: pat-s R_LIBS_USER: /tmp/R-pkgs FLAT_SAFETY_ARCH: ${ARCH} diff --git a/.crow/reindex.yaml b/.crow/reindex.yaml index 528def4..71bca2c 100644 --- a/.crow/reindex.yaml +++ b/.crow/reindex.yaml @@ -151,6 +151,14 @@ steps: from_secret: PGPASS REPO_RO_TOKEN: from_secret: REPO_RO_TOKEN + # uvr resolves bincraft's dependencies through the GitHub API, including + # the pat-s/cranlike@s3 fork. Unauthenticated it is rate limited, and the + # failure is not loud: uvr warns, falls back to the registry copy of + # cranlike, and the index write then dies on `unused argument (built = + # built)` because upstream has no such parameter. Intermittent by nature, + # since it depends on the rate-limit window. + GITHUB_PAT: + from_secret: GITHUB_PAT GIT_USER: pat-s R_LIBS_USER: /mnt/cache/R-pkgs R_VERSION: ${R_VERSION} diff --git a/.crow/weekly-rebuild-reindex.yaml b/.crow/weekly-rebuild-reindex.yaml index 8de71f7..66603e3 100644 --- a/.crow/weekly-rebuild-reindex.yaml +++ b/.crow/weekly-rebuild-reindex.yaml @@ -154,6 +154,14 @@ steps: from_secret: PGPASS REPO_RO_TOKEN: from_secret: REPO_RO_TOKEN + # uvr resolves bincraft's dependencies through the GitHub API, including + # the pat-s/cranlike@s3 fork. Unauthenticated it is rate limited, and the + # failure is not loud: uvr warns, falls back to the registry copy of + # cranlike, and the index write then dies on `unused argument (built = + # built)` because upstream has no such parameter. Intermittent by nature, + # since it depends on the rate-limit window. + GITHUB_PAT: + from_secret: GITHUB_PAT GIT_USER: pat-s R_LIBS_USER: /mnt/cache/R-pkgs R_VERSION: ${R_VERSION}