- Add local/seed-pure-r.R, opt-in via SEED_FROM on install-deps: copy pure-R
binaries server-side from a slot of the same OS family and arch, after
verifying each is a binary, has no compiled code, was built by the primary
R minor, and passes bincraft's cross-minor ABI check; write the
single_builds and abi_flat_safety rows an upload would.
- Interleave build-all shards with shard_slice() instead of contiguous
alphabetical blocks, which ranged from 0.1h to 28h per shard.
- Share one BUILD_DEADLINE (BUILD_BUDGET_HOURS, default 44h) across every
build pass of a build-all-versions step so long runs stop cleanly and
still archive and index what they built.
- Derive the single_builds platform with codename_platform() instead of a
hard-coded list.
Follow-up to #240.
The bulk skip in `build-newer-r.R` never took effect: in all 16 `process-updates` runs on `773add0` (14300–14315) the ABI-verdict query failed with `root certificate file "/root/.postgresql/root.crt" does not exist`.
The fallback did its job: every run logged `0 of 1323 already carry a binary … 1323 left for bincraft` and built exactly as before. So nothing broke, but the run saved no time either.
## Changes
- `local/build-newer-r.R`: pass `sslrootcert = bincraft::postgres_sslrootcert("verify-full")` to the connection, as every other DB script in `local/` already does. With `verify-full` and no `sslrootcert`, libpq looks for `~/.postgresql/root.crt`.
## Verification
- In the `build-env-ubuntu:jammy`, `build-env-redhat:9` and `build-env-alpine:3.24` images, connecting with the distro's CA bundle gets past TLS verification to password authentication (tested with a deliberately wrong password).
- The S3 listings in the same runs logged no errors.
## Behaviour change
- The next runs should log a non-zero "N of M already carry a binary at their routed path" count and skip those candidates without calling bincraft.
Reviewed-on: #241
Step 1 of rpkgs/bincraft#211: pass the metadata database explicitly so bincraft can drop its implicit production defaults.
## Changes
- Pass `metadata_db_*` explicitly to every per-minor `upload_package_index()` call in `reindex.yaml`, `process-updates.yaml`, `weekly-rebuild-reindex.yaml`, `build-all-versions.yaml` and `prune-stale-flat-binaries.yaml`.
- Replace `|| true` in those per-minor loops with a list of failed minors: every minor is still attempted, then the step exits 1 naming the ones that failed.
- Give the "Upload package indexes" step of `build-all-versions.yaml` the `PGPASS` secret. It never had it, so its per-minor reindexes always aborted and `|| true` hid that.
- Run the CDN purge in `process-updates.yaml` and `prune-stale-flat-binaries.yaml` even when a reindex failed, as `reindex.yaml` and `weekly-rebuild-reindex.yaml` already do, because the generic index was still replaced.
- `local/repair-built-stamp.R` passes the database too, and fails once all minors are tried instead of only printing the error.
The generic (non-per-minor) calls are unchanged: they never read the database.
## Behaviour change
A per-minor reindex that fails now turns the pipeline red instead of passing silently.
Expect build-all-versions runs to start reindexing per-minor slots for real, since they now have the password.
## Ordering
Merge this before rpkgs/bincraft's companion PR is released: `local/install-bincraft.R` installs the latest bincraft tag, and the explicit arguments work with both the current and the next release.
Reviewed-on: #234
