fix(ci): derive build-all platform/arch in-container, not from CI env

Crow cannot interpolate the workflow-level OS/OS_VERSION form variables inside
an environment: block (only matrix variables work there), so exporting them
broke pipeline parsing with "unable to parse variable name".

Instead, derive platform + arch inside build-all.R from the running container,
mirroring bincraft's own codename -> platform mapping and machine -> arch
detection. This keeps the already-built dedup pre-filter effective without
depending on CI-injected env vars, and degrades to a length-1 NA (querying
nothing) for an unmapped codename rather than crashing.

.crow/build-all-versions-install-deps.yaml

@@ -62,8 +62,9 @@ steps:
       # - rm -rf /mnt/cache/R-pkgs
       - mkdir -p /mnt/cache/pkgcache /mnt/cache/R-pkgs /mnt/cache/ccache /mnt/cache/packages
       - git clone -q https://pat-s:$$REPO_RO_TOKEN@git.devxy.io/devxy/build-cran-binaries.git .
-      - git clone -q https://codefloe.com/rpkgs/bincraft.git /tmp/bincraft
-      - /opt/R/$R_VERSION/bin/R -q -e 'pak::sysreqs_db_update(); pak::local_install("/tmp/bincraft"); pak::pak(c("RPostgres", "s3fs", "data.table", "future", "jsonlite")); packageVersion("bincraft")'
+      # Pin the same bincraft version the build steps use, so the precomputed
+      # snapshot and the per-agent library stay consistent across the pipeline.
+      - /opt/R/$R_VERSION/bin/R -q -e 'pak::sysreqs_db_update(); pak::pak("git::https://codefloe.com/rpkgs/bincraft.git@v4.2.3"); pak::pak(c("RPostgres", "s3fs", "data.table", "future", "jsonlite")); packageVersion("bincraft")'
       - /opt/R/$R_VERSION/bin/R -q -e "source('local/packages-to-build.R'); saveRDS(pkgs, '/mnt/cache/packages/pkgs_to_build.rds'); saveRDS(pkgs[r_minor_sensitive == TRUE], '/mnt/cache/packages/r_minor_sensitive_pkgs.rds'); sprintf('Precomputed %s package versions (%s r-minor-sensitive)', nrow(pkgs), nrow(pkgs[r_minor_sensitive == TRUE]))"
     backend_options:
       docker:

.crow/build-all-versions.yaml

@@ -100,6 +100,14 @@ steps:
     commands:
       - git clone -q https://pat-s:$$REPO_RO_TOKEN@git.devxy.io/devxy/build-cran-binaries.git .
       - mkdir -p /mnt/cache/pkgcache /mnt/cache/R-pkgs /mnt/cache/ccache /mnt/cache/packages
+      # The primary pass must not rely on build-all-versions-install-deps having
+      # run on *this* agent: depends_on only orders the steps, but the cache
+      # volume is per-agent, so a job landing on an agent where install-deps did
+      # not run would otherwise use a stale bincraft (which resolves `platform`
+      # to a zero-length value and breaks every metadata query and the sysdeps
+      # install). Pin bincraft here, exactly like the R-minor pass below.
+      - rm -rf /mnt/cache/R-pkgs/00LOCK-*
+      - /opt/R/$R_VERSION/bin/R -q -e 'if (!requireNamespace("bincraft", quietly = TRUE) || packageVersion("bincraft") != "4.2.3") pak::pak("git::https://codefloe.com/rpkgs/bincraft.git@v4.2.3")'
       - XVFB=$(command -v xwfb-run 2>/dev/null || command -v xvfb-run); XVFB_ARGS=""; if command -v xwfb-run >/dev/null 2>&1; then dnf install -y -q weston 2>/dev/null; XVFB_ARGS="-c weston"; fi
       - $XVFB $XVFB_ARGS -n $SPLIT_INDEX -- /opt/R/$R_VERSION/bin/Rscript local/build-all.R $SPLIT_INTO $SPLIT_INDEX $NCPUS 2>&1
       - |
@@ -111,11 +119,12 @@ steps:
           echo "=== R-minor-sensitive pass under R $RV ==="
           LIB="/mnt/cache/R-pkgs-$RMINOR"
           mkdir -p "$LIB"
-          R_LIBS_USER="$LIB" "$(dirname "$RBIN")/R" -q -e 'if (!requireNamespace("bincraft", quietly = TRUE) || packageVersion("bincraft") != "4.2.2") pak::pak("git::https://codefloe.com/rpkgs/bincraft.git@v4.2.2")' || true
+          R_LIBS_USER="$LIB" "$(dirname "$RBIN")/R" -q -e 'if (!requireNamespace("bincraft", quietly = TRUE) || packageVersion("bincraft") != "4.2.3") pak::pak("git::https://codefloe.com/rpkgs/bincraft.git@v4.2.3")' || true
           R_LIBS_USER="$LIB" $XVFB $XVFB_ARGS -n $SPLIT_INDEX -- "$(dirname "$RBIN")/Rscript" local/build-all.R --sensitive-only $SPLIT_INTO $SPLIT_INDEX $NCPUS 2>&1 || true
         done
-      # archive missed packages
-      - /opt/R/$R_VERSION/bin/R -q -e "bincraft::process_unarchived_pkgs(paste(Sys.getenv('OS'), Sys.getenv('OS_VERSION')), Sys.getenv('ARCH'), workers = $NCPUS)"
+      # archive missed packages; first arg is the codename (e.g. "alpine324"),
+      # derived via bincraft like the upload step, not paste(OS, OS_VERSION).
+      - /opt/R/$R_VERSION/bin/R -q -e "bincraft::process_unarchived_pkgs(bincraft::set_codename(NULL), Sys.getenv('ARCH'), workers = $NCPUS)"
     backend_options:
       docker:
         resources:

local/build-all.R

@@ -15,6 +15,31 @@ library(bincraft, quietly = TRUE)
 library(future)
 plan("sequential")
 
+# The install-deps step precomputes the package snapshot into /mnt/cache, but
+# that volume is per-agent: a job landing on a fresh agent (or racing
+# install-deps) finds it empty. Recompute the snapshot here when any part is
+# missing, so the first job on an agent repopulates the cache for the jobs that
+# follow; concurrent jobs that also miss simply redo the work. Write via a
+# temp file + atomic rename so a concurrent reader never sees a half-written rds.
+package_cache_files <- c(
+  "/mnt/cache/packages/pkgs_to_build.rds",
+  "/mnt/cache/packages/r_minor_sensitive_pkgs.rds",
+  "/mnt/cache/packages/s3_cache.rds"
+)
+if (!all(file.exists(package_cache_files))) {
+  message("Package snapshot missing from cache; recomputing via packages-to-build.R")
+  dir.create("/mnt/cache/packages", showWarnings = FALSE, recursive = TRUE)
+  save_rds_atomic <- function(obj, path) {
+    tmp <- paste0(path, ".tmp.", Sys.getpid())
+    saveRDS(obj, tmp)
+    file.rename(tmp, path)
+  }
+  source(file.path("local", "packages-to-build.R"))
+  save_rds_atomic(pkgs, "/mnt/cache/packages/pkgs_to_build.rds")
+  save_rds_atomic(pkgs[r_minor_sensitive == TRUE], "/mnt/cache/packages/r_minor_sensitive_pkgs.rds")
+  message("Package snapshot recomputed.")
+}
+
 pkgs <- if (sensitive_only) {
   readRDS("/mnt/cache/packages/r_minor_sensitive_pkgs.rds")
 } else {
@@ -43,8 +68,31 @@ chunk <- chunk[!chunk$Package %in% exclude, ]
 # pkgs_to_build.rds is a static snapshot from the install-deps step, so on a
 # restart it still lists everything an interrupted run already produced. The
 # metadata DB reflects that progress, so we re-derive the remaining set here.
-platform <- paste(Sys.getenv("OS"), gsub("[.]", "", Sys.getenv("OS_VERSION")), sep = "-")
-arch <- Sys.getenv("ARCH")
+# Derive platform + arch from the running container, mirroring the codename ->
+# platform mapping bincraft uses internally. The OS/OS_VERSION selectors are
+# workflow-level CI variables that are not injected into the container
+# environment, so Sys.getenv() would return "" and this pre-filter would query
+# platform "-" and skip nothing.
+codename <- bincraft::set_codename(NULL)
+platform <- switch(
+  codename,
+  jammy = "ubuntu-2204",
+  noble = "ubuntu-2404",
+  resolute = "ubuntu-2604",
+  rhel10 = "redhat-10",
+  rhel9 = "redhat-9",
+  rhel8 = "redhat-8",
+  alpine320 = "alpine-320",
+  alpine321 = "alpine-321",
+  alpine322 = "alpine-322",
+  alpine323 = "alpine-323",
+  alpine324 = "alpine-324",
+  alpine325 = "alpine-325",
+  alpine326 = "alpine-326",
+  NA_character_
+)
+local_machine <- Sys.info()[["machine"]]
+arch <- if (grepl("arm64|aarch64", local_machine)) "arm64" else "amd64"
 con <- DBI::dbConnect(
   RPostgres::Postgres(),
   dbname = "build_metadata",