refactor: collapse cdn.tf pullzones into for_each

bunnynet_pullzone.devxy-r-binaries (cran.devxy.io) and bunnynet_pullzone.cran_rpkgs_com (cran.rpkgs.com) were byte-for-byte identical except for the zone name and hostname. Same for the two pullzone_hostname resources. Use a single local.pullzones map and for_each on both resources, so shared knobs (block_ips, limit_bandwidth, s3_auth_*, ...) only have to be edited once. State migration is handled by moved {} blocks so the existing pullzones get re-addressed under the new for_each keys instead of being destroyed+recreated. Run terraform plan to confirm a zero- change apply before applying.
2026-05-28 15:52:28 +02:00
156 changed files with 3916 additions and 14590 deletions
--- a/.crow/archive-missed-packages.yaml
+++ b/.crow/archive-missed-packages.yaml
@ -6,6 +6,7 @@ when:
  - event: cron
    cron: archive-missed-packages

+
 matrix:
  include:
    - CODENAME: jammy
@ -24,18 +25,18 @@ matrix:
      ARCH: amd64
    - CODENAME: redhat-9
      ARCH: arm64
-    - CODENAME: redhat-10
+    - CODENAME: alpine321
      ARCH: amd64
-    - CODENAME: redhat-10
+    - CODENAME: alpine321
      ARCH: arm64
-    - CODENAME: alpine323
+    - CODENAME: alpine322
      ARCH: amd64
-    - CODENAME: alpine323
+    - CODENAME: alpine322
      ARCH: arm64

 steps:
  - name: 'Archive missed packages'
-    image: reg.devxy.io/rpkgs/build-env-alpine:3.24
+    image: reg.devxy.io/rpkgs/build-env-alpine:3.23
    pull: true
    environment:
      RED_HAT_DEV_PW:
@ -54,9 +55,9 @@ steps:
      GIT_USER: pat-s
      R_VERSION: 4.5.3
    commands:
-      - /opt/R/$R_VERSION/bin/Rscript local/install-bincraft.R
+      - /opt/R/$R_VERSION/bin/R -q -e 'if (!requireNamespace("bincraft", quietly = TRUE) || packageVersion("bincraft") != "4.1.0") pak::pak("git::https://codefloe.com/rpkgs/bincraft.git@v4.1.0", dependencies = TRUE)'
      - /opt/R/$R_VERSION/bin/R -q -e 'packageVersion("bincraft")'
-      - /opt/R/$R_VERSION/bin/R -q -e 'bincraft::process_unarchived_pkgs(Sys.getenv("CODENAME"), Sys.getenv("ARCH"), s3_endpoint = "https://s3.eu-central-003.backblazeb2.com", s3_region = "eu-central-003", s3_bucket = "devxy-rpkgs-binaries", s3_access_key_id = Sys.getenv("B2_S3_ACCESS_KEY"), s3_secret_access_key = Sys.getenv("B2_S3_SECRET_KEY"), workers = 2L)'
+      - /opt/R/$R_VERSION/bin/R -q -e 'bincraft::process_unarchived_pkgs(Sys.getenv("CODENAME"), Sys.getenv("ARCH"), workers = 2L)'
    backend_options:
      kubernetes:
        resources:
--- a/.crow/auto-apply-patches.yaml
+++ b/.crow/auto-apply-patches.yaml
@ -1,76 +0,0 @@
-# Auto-apply registry patches (issue #115, step 3 automation).
-# Classifies `single_builds` failures and, for the top-N auto-proposable
-# candidates by failure volume, writes the registry entries onto the reused
-# `auto/registry-patch-proposals` branch and opens/updates a single PR.
-# Nothing merges: the `trial-build-registry` pipeline is the merge gate, and a
-# human reviews the PR. Novel source diffs / unknown signatures are never
-# proposed. Global across platforms, so a single job -- no matrix.
-#
-# FORGEJO_TOKEN is used for both the branch push and opening the PR (no separate
-# write-scoped secret needed). Register the `auto-apply-patches` cron in the crow
-# UI, or run manually:
-#   crow pipeline create --branch main \
-#     --var auto_apply_patches=true devxy/build-cran-binaries
-#
-# The gate variable is `auto_apply_patches`, named after the pipeline: a manual
-# run instantiates every pipeline in `.crow/`, so one without its own gate runs
-# on *any* manual trigger in this repo. This one pushes a branch and opens a PR,
-# so it must stay off unless it is what was asked for.
-variables:
-  auto_apply_patches:
-    description: 'Run the auto-patch proposer. Also gates this pipeline.'
-    options:
-      - 'true'
-      - 'false'
-    default: 'false'
-  patch_limit:
-    description: 'Max candidates to propose per run (top by failure volume).'
-    default: '10'
-
-when:
-  - event: manual
-    evaluate: 'auto_apply_patches == "true"'
-  - event: cron
-    cron: auto-apply-patches
-
-skip_clone: true
-
-labels:
-  group: rpkgs-amd64
-
-steps:
-  - name: 'Auto-apply registry patches'
-    image: reg.devxy.io/rpkgs/build-env-alpine:3.24
-    pull: true
-    environment:
-      PGPASS:
-        from_secret: PGPASS
-      REPO_RO_TOKEN:
-        from_secret: REPO_RO_TOKEN
-      FORGEJO_TOKEN:
-        from_secret: FORGEJO_TOKEN
-      GIT_USER: devxy-bot
-      GIT_EMAIL: bot@devxy.io
-      PATCH_LIMIT: ${patch_limit}
-      R_VERSION: 4.5.3
-      R_LIBS_USER: /mnt/cache/R-pkgs
-    commands:
-      - git clone -q https://pat-s:$$REPO_RO_TOKEN@git.devxy.io/devxy/build-cran-binaries.git .
-      - mkdir -p /mnt/cache/R-pkgs
-      - rm -rf /mnt/cache/R-pkgs/00LOCK-*
-      - UVR_R_BIN=/opt/R/$R_VERSION/bin/R local/uvr-install.sh RPostgres httr2 jsonlite
-      - /opt/R/$R_VERSION/bin/Rscript local/propose-patches.R --open-pr --limit $PATCH_LIMIT
-    backend_options:
-      kubernetes:
-        resources:
-          requests:
-            memory: 1Gi
-            cpu: 2000m
-          limits:
-            memory: 2Gi
-            cpu: 2000m
-        tolerations:
-          - key: 'CI'
-            operator: 'Equal'
-            value: 'true'
-            effect: 'NoSchedule'
--- a/.crow/backfill-abi-classification.yaml
+++ b/.crow/backfill-abi-classification.yaml
@ -1,90 +0,0 @@
-# Populate the ABI classifier cache for packages that predate the per-minor scheme.
-#
-# bincraft decides whether a flat binary may be carried into a per-minor index
-# from its risky-package set. That set is now the union of the per-minor tarball
-# scan and the `abi_classification` cache, but the cache only holds verdicts for
-# packages that passed through the build pipeline after the scheme existed.
-# Everything older has no verdict, and no verdict means "carry it" - which is how
-# a base64enc built under R 4.4.3 reached R 4.6 clients and died at dyn.load()
-# on SETLENGTH.
-#
-# The verdict is computed from the package source, so it does not depend on OS,
-# arch or R minor: one run populates the cache for every slot. The arch/codename
-# below only choose which flat index to enumerate.
-#
-# Re-running is cheap. Cached verdicts are returned without touching the network,
-# so a second run costs one query per package and downloads only what is still
-# unclassified.
-#
-#   crow pipeline create devxy/build-cran-binaries --var backfill_abi=run
-
-variables:
-  # A manual pipeline creation instantiates every file in .crow/, so the default
-  # must be a value the `when` clause rejects.
-  backfill_abi:
-    description: "Set to 'run' to classify the flat index into the ABI cache."
-    options:
-      - none
-      - run
-    default: none
-  BACKFILL_ARCH:
-    description: 'Arch of the flat index to enumerate.'
-    options:
-      - amd64
-      - arm64
-    default: amd64
-  BACKFILL_CODENAME:
-    description: 'Codename of the flat index to enumerate.'
-    default: resolute
-  BACKFILL_LIMIT:
-    description: 'Classify at most this many packages (0 = no limit).'
-    default: '0'
-
-when:
-  - event: manual
-    evaluate: 'backfill_abi == "run"'
-
-skip_clone: true
-
-labels:
-  group: rpkgs-amd64
-
-steps:
-  - name: 'Classify the flat index into the ABI cache'
-    image: reg.devxy.io/rpkgs/build-env-ubuntu:resolute
-    pull: true
-    environment:
-      OTEL_R_TRACES_EXPORTER: none
-      OTEL_R_LOGS_EXPORTER: none
-      OTEL_R_METRICS_EXPORTER: none
-      PGPASS:
-        from_secret: PGPASS
-      REPO_RO_TOKEN:
-        from_secret: REPO_RO_TOKEN
-      GITHUB_PAT:
-        from_secret: GITHUB_PAT
-      GIT_USER: pat-s
-      # Pipeline variables are substituted into the YAML, not exported, so they
-      # have to be bound here to be readable as env vars in the script below.
-      BACKFILL_ARCH: ${BACKFILL_ARCH}
-      BACKFILL_CODENAME: ${BACKFILL_CODENAME}
-      BACKFILL_LIMIT: ${BACKFILL_LIMIT}
-      R_LIBS_USER: /tmp/R-pkgs
-    commands:
-      - git clone -q https://pat-s:$$REPO_RO_TOKEN@git.devxy.io/devxy/build-cran-binaries.git .
-      - mkdir -p /tmp/R-pkgs
-      - /opt/R/4.5.3/bin/Rscript local/install-bincraft.R
-      - |
-        set -eu
-        LIMIT=""
-        if [ "$$BACKFILL_LIMIT" != "0" ]; then
-          LIMIT="$$BACKFILL_LIMIT"
-        fi
-        /opt/R/4.5.3/bin/Rscript local/backfill-abi-classification.R \
-          "$$BACKFILL_ARCH" "$$BACKFILL_CODENAME" $$LIMIT
-    backend_options:
-      docker:
-        resources:
-          requests:
-            memory: 4Gi
-            cpu: 1000m
--- a/.crow/backfill-flat-safety.yaml
+++ b/.crow/backfill-flat-safety.yaml
@ -1,176 +0,0 @@
-# Record, per flat-slot object, whether it loads under every supported R minor.
-#
-# `union_index_records()` keeps a carried flat record when that object is
-# recorded safe and drops it otherwise. Objects uploaded before that record
-# existed have no verdict, so they are dropped: a full re-index removed roughly
-# 2000 records per per-minor index (16398 across the 4.4 indexes, 20076 across
-# 4.5, 15532 across 4.6), each one resolving to CRAN source for clients the
-# routing serves correctly.
-#
-# This inspects what is already in the bucket and writes the verdict, which is
-# what restores that coverage. Decided by symbols rather than heuristics: a
-# binary fails at dyn.load() under minor M exactly when it references a symbol M
-# does not export, and the volatile set is derived by diffing the R builds in
-# the image.
-#
-# Re-running is cheap; recorded objects are skipped.
-#
-#   crow pipeline create devxy/build-cran-binaries --var flat_safety=all
-
-variables:
-  # A manual pipeline creation instantiates every file in .crow/, so the default
-  # must match no matrix row.
-  flat_safety:
-    description: "Inspect target: a specific <os>-<arch>, 'all' for every slot, or 'none'."
-    options:
-      - none
-      - all
-      - alpine-323-amd64
-      - alpine-323-arm64
-      - alpine-324-amd64
-      - alpine-324-arm64
-      - redhat-8-amd64
-      - redhat-8-arm64
-      - redhat-9-amd64
-      - redhat-9-arm64
-      - redhat-10-amd64
-      - redhat-10-arm64
-      - ubuntu-2204-amd64
-      - ubuntu-2204-arm64
-      - ubuntu-2404-amd64
-      - ubuntu-2404-arm64
-      - ubuntu-2604-amd64
-      - ubuntu-2604-arm64
-    default: none
-  FLAT_SAFETY_LIMIT:
-    description: 'Inspect at most this many objects per slot (0 = no limit).'
-    default: '0'
-
-when:
-  - event: manual
-    evaluate: 'flat_safety == "all" || flat_safety == "${OS}-${ARCH}"'
-
-skip_clone: true
-
-labels:
-  group: rpkgs-${ARCH}
-
-matrix:
-  include:
-    - OS: alpine-323
-      ARCH: amd64
-      R_VERSION: 4.5.3
-      IMG: alpine:3.23
-    - OS: alpine-323
-      ARCH: arm64
-      R_VERSION: 4.5.3
-      IMG: alpine:3.23
-    - OS: alpine-324
-      ARCH: amd64
-      R_VERSION: 4.5.3
-      IMG: alpine:3.24
-    - OS: alpine-324
-      ARCH: arm64
-      R_VERSION: 4.5.3
-      IMG: alpine:3.24
-    - OS: redhat-8
-      ARCH: amd64
-      R_VERSION: 4.4.3
-      IMG: redhat:8
-    - OS: redhat-8
-      ARCH: arm64
-      R_VERSION: 4.4.3
-      IMG: redhat:8
-    - OS: redhat-9
-      ARCH: amd64
-      R_VERSION: 4.4.3
-      IMG: redhat:9
-    - OS: redhat-9
-      ARCH: arm64
-      R_VERSION: 4.4.3
-      IMG: redhat:9
-    - OS: redhat-10
-      ARCH: amd64
-      R_VERSION: 4.5.3
-      IMG: redhat:10
-    - OS: redhat-10
-      ARCH: arm64
-      R_VERSION: 4.5.3
-      IMG: redhat:10
-    - OS: ubuntu-2204
-      ARCH: amd64
-      R_VERSION: 4.4.3
-      IMG: ubuntu:jammy
-    - OS: ubuntu-2204
-      ARCH: arm64
-      R_VERSION: 4.4.3
-      IMG: ubuntu:jammy
-    - OS: ubuntu-2404
-      ARCH: amd64
-      R_VERSION: 4.4.3
-      IMG: ubuntu:noble
-    - OS: ubuntu-2404
-      ARCH: arm64
-      R_VERSION: 4.4.3
-      IMG: ubuntu:noble
-    - OS: ubuntu-2604
-      ARCH: amd64
-      R_VERSION: 4.4.3
-      IMG: ubuntu:resolute
-    - OS: ubuntu-2604
-      ARCH: arm64
-      R_VERSION: 4.4.3
-      IMG: ubuntu:resolute
-
-steps:
-  - name: 'Inspect flat objects and record safety'
-    image: reg.devxy.io/rpkgs/build-env-${IMG}
-    pull: true
-    environment:
-      OTEL_R_TRACES_EXPORTER: none
-      OTEL_R_LOGS_EXPORTER: none
-      OTEL_R_METRICS_EXPORTER: none
-      RED_HAT_DEV_PW:
-        from_secret: RED_HAT_DEV_PW
-      B2_S3_ACCESS_KEY:
-        from_secret: B2_S3_ACCESS_KEY
-      B2_S3_SECRET_KEY:
-        from_secret: B2_S3_SECRET_KEY
-      PGPASS:
-        from_secret: PGPASS
-      REPO_RO_TOKEN:
-        from_secret: REPO_RO_TOKEN
-      # uvr resolves bincraft's dependencies through the GitHub API, including
-      # the pat-s/cranlike@s3 fork. Unauthenticated it is rate limited, and the
-      # failure is not loud: uvr warns, falls back to the registry copy of
-      # cranlike, and the index write then dies on `unused argument (built =
-      # built)` because upstream has no such parameter. Intermittent by nature,
-      # since it depends on the rate-limit window.
-      GITHUB_PAT:
-        from_secret: GITHUB_PAT
-      GIT_USER: pat-s
-      R_LIBS_USER: /tmp/R-pkgs
-      FLAT_SAFETY_ARCH: ${ARCH}
-      FLAT_SAFETY_LIMIT: ${FLAT_SAFETY_LIMIT}
-    commands:
-      - git clone -q https://pat-s:$$REPO_RO_TOKEN@git.devxy.io/devxy/build-cran-binaries.git .
-      - mkdir -p /tmp/R-pkgs
-      - /opt/R/$R_VERSION/bin/Rscript local/install-bincraft.R
-      - |
-        set -eu
-        LIMIT=""
-        if [ "$$FLAT_SAFETY_LIMIT" != "0" ]; then
-          LIMIT="$$FLAT_SAFETY_LIMIT"
-        fi
-        # The codename comes from the image's /etc/os-release, exactly as the
-        # re-index step derives it, so it cannot drift from the matrix.
-        CODENAME=$(/opt/R/$R_VERSION/bin/Rscript -e 'cat(bincraft::set_codename(NULL))')
-        echo "slot: $$FLAT_SAFETY_ARCH/$$CODENAME"
-        /opt/R/$R_VERSION/bin/Rscript local/backfill-flat-safety.R \
-          "$$FLAT_SAFETY_ARCH" "$$CODENAME" $$LIMIT
-    backend_options:
-      docker:
-        resources:
-          requests:
-            memory: 4Gi
-            cpu: 1000m
--- a/.crow/build-all-versions-amd64.yaml
+++ b/.crow/build-all-versions-amd64.yaml
@ -0,0 +1,99 @@
+### Required extra vars
+# ARCH (amd64)
+# OS (alpine)
+# OS_VERSION (3.22)
+# R_VERSION (4.5.3)
+# crow pipeline create --var ARCH=arm64 --var OS=alpine --var OS_VERSION=3.23 --var R_VERSION=4.5.3 --var task=build-all-arm64 --branch=main --log-level=info 5
+# crow pipeline create --var ARCH=arm64 --var OS=redhat --var OS_VERSION=10 --var R_VERSION=4.5.3 --var task=build-all-arm64 --branch=main --log-level=info 5
+# crow pipeline create --var ARCH=amd64 --var OS=redhat --var OS_VERSION=10 --var R_VERSION=4.5.3 --var task=build-all-amd64 --branch=main --log-level=info 5
+when:
+  - event: manual
+    evaluate: 'task == "build-all-amd64"'
+
+skip_clone: true
+
+labels:
+  platform: linux/amd64
+  agent: artemis
+
+matrix:
+  include:
+    - SPLIT_INTO: 4
+      SPLIT_INDEX: 1
+      BACKEND: kubernetes
+    - SPLIT_INTO: 4
+      SPLIT_INDEX: 2
+      BACKEND: kubernetes
+    - SPLIT_INTO: 4
+      SPLIT_INDEX: 3
+      BACKEND: kubernetes
+    - SPLIT_INTO: 4
+      SPLIT_INDEX: 4
+      BACKEND: kubernetes
+    # - SPLIT_INTO: 4
+    #   SPLIT_INDEX: 5
+    #   BACKEND: kubernetes
+
+depends_on:
+  - build-all-versions-install-deps-amd64
+
+steps:
+  - name: 'Build binaries'
+    image: "reg.devxy.io/rpkgs/build-env-${OS}:${OS_VERSION}"
+    pull: true
+    environment:
+      RED_HAT_DEV_PW:
+        from_secret: RED_HAT_DEV_PW
+      B2_S3_ACCESS_KEY:
+        from_secret: B2_S3_ACCESS_KEY
+      B2_S3_SECRET_KEY:
+        from_secret: B2_S3_SECRET_KEY
+      PGPASS:
+        from_secret: PGPASS
+      REPO_RO_TOKEN:
+        from_secret: REPO_RO_TOKEN
+      GITHUB_PAT:
+        from_secret: GITHUB_PAT
+      # normal env vars
+      GIT_USER: pat-s
+      # set the location of the 'pkgcache' cache dir which persists the R package dependencies needed to install the packages themselves
+      R_PKG_CACHE_DIR: ""
+      R_LIBS_USER: /mnt/cache/R-pkgs
+      CCACHE_DIR: /mnt/cache/ccache
+      NCPUS: 2
+    volumes:
+      - ${ARCH}-binaries-r-dep-cache-${OS}-${OS_VERSION//./}:/mnt/cache
+    commands:
+      - git clone -q https://pat-s:$$REPO_RO_TOKEN@git.devxy.io/devxy/build-cran-binaries.git .
+      - mkdir -p /mnt/cache/pkgcache /mnt/cache/R-pkgs /mnt/cache/ccache /mnt/cache/packages
+      # Windows-only: 'RInno', 'KeyboardSimulator', 'R2PPT', 'RWinEdt', 'blatr', 'excel.link', 'spectrino', 'taskscheduleR', 'MDSGUI', 'BiplotGUI', 'R2wd', 'rFUSION', 'MediaNews', 'rFUSION', 'MediaNews'
+      # pkgs = readRDS('/mnt/cache/pkgs_amd64.rds');
+      - XVFB=$(command -v xwfb-run 2>/dev/null || command -v xvfb-run); XVFB_ARGS=""; if command -v xwfb-run >/dev/null 2>&1; then dnf install -y -q weston 2>/dev/null; XVFB_ARGS="-c weston"; fi
+      - $XVFB $XVFB_ARGS -n $SPLIT_INDEX -- /opt/R/$R_VERSION/bin/Rscript local/build-all.R $SPLIT_INTO $SPLIT_INDEX $NCPUS 2>&1
+      # archive missed packages
+      - /opt/R/$R_VERSION/bin/R -q -e "bincraft::process_unarchived_pkgs(paste(Sys.getenv('OS'), Sys.getenv('OS_VERSION')), Sys.getenv('ARCH'), workers = $NCPUS)"
+    backend_options:
+      docker:
+        resources:
+          requests:
+            memory: 5Gi
+            cpu: 1000m
+          limits:
+            memory: 20Gi
+            cpu: 2000m
+      kubernetes:
+        resources:
+          requests:
+            memory: 5Gi
+            cpu: 1000m
+          limits:
+            memory: 20Gi
+            cpu: 2000m
+        nodeSelector:
+          kubernetes.io/arch: ${ARCH}
+          node.kubernetes.io/instance-type: ${K8S_INSTANCE_TYPE}
+        tolerations:
+          - key: 'CI'
+            operator: 'Equal'
+            value: 'true'
+            effect: 'NoSchedule'
--- a/.crow/build-all-versions-arm64.yaml
+++ b/.crow/build-all-versions-arm64.yaml
@ -0,0 +1,112 @@
+### Required extra vars
+# ARCH (amd64)
+# OS (alpine)
+# OS_VERSION (3.22)
+# R_VERSION (4.5.3)
+# echo "c('RInno','KeyboardSimulator','R2PPT','RWinEdt','blatr','excel.link','spectrino','taskscheduleR','MDSGUI','BiplotGUI','R2wd','rFUSION','MediaNews','doBy','IDPmisc','frailtypack','afex','FrF2','DoE.base','agricolae','doFuture','fscaret','PHYLOGR','seewave','pls','relaimpo','geepack','gggenes','NPCirc','repmis','PNDSIBGE','lidR','poismf','neonstore','MachineShop','mvst','MacBehaviour','mcmcderive','RGIFT','KnowBR','netmeta','spdep','sf','Rfast','compareGroups','ff','GsymPoint','RcppDynProg','comtradr','RcppDynProg','FD','PearsonDS','DCluster','gRc','mixlm','geospt','fdth','ffmanova','fiery','ffscrapr','cold','fiery','RcmdrPlugin.DoE','RcmdrPlugin.NMBU')" | base64
+# crow pipeline create --var ARCH=arm64 --var OS=alpine --var OS_VERSION=3.22 --var R_VERSION=4.5 --var task=build-all-arm64 --var K8S_INSTANCE_TYPE=cax41 --branch=main --var SKIP_PKGS=YygnUklubm8nLCdLZXlib2FyZFNpbXVsYXRvcicsJ1IyUFBUJywnUldpbkVkdCcsJ2JsYXRyJywnZXhjZWwubGluaycsJ3NwZWN0cmlubycsJ3Rhc2tzY2hlZHVsZVInLCdNRFNHVUknLCdCaXBsb3RHVUknLCdSMndkJywnckZVU0lPTicsJ01lZGlhTmV3cycsJ2RvQnknLCdJRFBtaXNjJywnZnJhaWx0eXBhY2snLCdhZmV4JywnRnJGMicsJ0RvRS5iYXNlJywnYWdyaWNvbGFlJywnZG9GdXR1cmUnLCdmc2NhcmV0JywnUEhZTE9HUicsJ3NlZXdhdmUnLCdwbHMnLCdyZWxhaW1wbycsJ2dlZXBhY2snLCdnZ2dlbmVzJywnTlBDaXJjJywncmVwbWlzJywnUE5EU0lCR0UnLCdsaWRSJywncG9pc21mJywnbmVvbnN0b3JlJywnTWFjaGluZVNob3AnLCdtdnN0JywnTWFjQmVoYXZpb3VyJywnbWNtY2Rlcml2ZScsJ1JHSUZUJywnS25vd0JSJywnbmV0bWV0YScsJ3NwZGVwJywnc2YnLCdSZmFzdCcsJ2NvbXBhcmVHcm91cHMnLCdmZicsJ0dzeW1Qb2ludCcsJ1JjcHBEeW5Qcm9nJywnY29tdHJhZHInLCdSY3BwRHluUHJvZycsJ0ZEJywnUGVhcnNvbkRTJywnRENsdXN0ZXInLCdnUmMnLCdtaXhsbScsJ2dlb3NwdCcsJ2ZkdGgnLCdmZm1hbm92YScsJ2ZpZXJ5JywnZmZzY3JhcHInLCdjb2xkJywnZmllcnknLCdSY21kclBsdWdpbi5Eb0UnLCdSY21kclBsdWdpbi5OTUJVJykK --log-level=info 7
+# crow pipeline create --var ARCH=arm64 --var OS=alpine --var OS_VERSION=3.23 --var R_VERSION=4.5 --var task=build-all-arm64 --var K8S_INSTANCE_TYPE=cax41 --branch=main --log-level=info 5
+# crow pipeline create --var ARCH=arm64 --var OS=redhat --var OS_VERSION=10 --var R_VERSION=4.5.3 --var task=build-all-arm64 --branch=main --log-level=info 5
+when:
+  - event: manual
+    evaluate: 'task == "build-all-arm64"'
+
+skip_clone: true
+
+labels:
+  agent: gaia
+
+matrix:
+  include:
+    # - SPLIT_INTO: 5
+    #   SPLIT_INDEX: 1
+    #   BACKEND: kubernetes
+    # - SPLIT_INTO: 5
+    #   SPLIT_INDEX: 2
+    #   BACKEND: kubernetes
+    # - SPLIT_INTO: 5
+    #   SPLIT_INDEX: 3
+    #   BACKEND: kubernetes
+    # - SPLIT_INTO: 5
+    #   SPLIT_INDEX: 4
+    #   BACKEND: kubernetes
+    # - SPLIT_INTO: 5
+    #   SPLIT_INDEX: 5
+    #   BACKEND: kubernetes
+    - SPLIT_INTO: 4
+      SPLIT_INDEX: 1
+      BACKEND: docker
+    - SPLIT_INTO: 4
+      SPLIT_INDEX: 2
+      BACKEND: docker
+    - SPLIT_INTO: 4
+      SPLIT_INDEX: 3
+      BACKEND: docker
+    - SPLIT_INTO: 4
+      SPLIT_INDEX: 4
+      BACKEND: docker
+    # - SPLIT_INTO: 5
+    #   SPLIT_INDEX: 5
+    #   BACKEND: docker
+
+depends_on:
+  - build-all-versions-install-deps-arm64
+
+steps:
+  - name: 'Build binaries'
+    image: "reg.devxy.io/rpkgs/build-env-${OS}:${OS_VERSION}"
+    pull: true
+    environment:
+      RED_HAT_DEV_PW:
+        from_secret: RED_HAT_DEV_PW
+      B2_S3_ACCESS_KEY:
+        from_secret: B2_S3_ACCESS_KEY
+      B2_S3_SECRET_KEY:
+        from_secret: B2_S3_SECRET_KEY
+      PGPASS:
+        from_secret: PGPASS
+      REPO_RO_TOKEN:
+        from_secret: REPO_RO_TOKEN
+      GITHUB_PAT:
+        from_secret: GITHUB_PAT
+      # normal env vars
+      GIT_USER: pat-s
+      # set the location of the 'pkgcache' cache dir which persists the R package dependencies needed to install the packages themselves
+      R_PKG_CACHE_DIR: /mnt/cache/pkgcache
+      R_LIBS_USER: /mnt/cache/R-pkgs
+      CCACHE_DIR: /mnt/cache/ccache
+      NCPUS: 2
+    volumes:
+      - ${ARCH}-binaries-r-dep-cache-${OS}-${OS_VERSION//./}:/mnt/cache
+    commands:
+      - git clone -q https://pat-s:$$REPO_RO_TOKEN@git.devxy.io/devxy/build-cran-binaries.git .
+      - mkdir -p /mnt/cache/pkgcache /mnt/cache/R-pkgs /mnt/cache/ccache /mnt/cache/packages
+      - XVFB=$(command -v xwfb-run 2>/dev/null || command -v xvfb-run); XVFB_ARGS=""; if command -v xwfb-run >/dev/null 2>&1; then dnf install -y -q weston 2>/dev/null; XVFB_ARGS="-c weston"; fi
+      - $XVFB $XVFB_ARGS -n $SPLIT_INDEX -- /opt/R/$R_VERSION/bin/Rscript local/build-all.R $SPLIT_INTO $SPLIT_INDEX $NCPUS 2>&1
+      # archive missed packages
+      - /opt/R/$R_VERSION/bin/R -q -e "bincraft::process_unarchived_pkgs(paste(Sys.getenv('OS'), Sys.getenv('OS_VERSION')), Sys.getenv('ARCH'), workers = $NCPUS)"
+    backend_options:
+      docker:
+        resources:
+          requests:
+            memory: 5Gi
+            cpu: 1000m
+          limits:
+            memory: 20Gi
+            cpu: 2000m
+      kubernetes:
+        resources:
+          requests:
+            memory: 5Gi
+            cpu: 1000m
+          limits:
+            memory: 20Gi
+            cpu: 2000m
+        nodeSelector:
+          kubernetes.io/arch: ${ARCH}
+          node.kubernetes.io/instance-type: ${K8S_INSTANCE_TYPE}
+        tolerations:
+          - key: 'CI'
+            operator: 'Equal'
+            value: 'true'
+            effect: 'NoSchedule'
--- a/.crow/build-all-versions-install-deps-amd64.yaml
+++ b/.crow/build-all-versions-install-deps-amd64.yaml
@ -0,0 +1,57 @@
+when:
+  - event: manual
+    evaluate: 'task == "build-all-amd64"'
+
+skip_clone: true
+
+labels:
+  platform: linux/${ARCH}
+  agent: artemis
+
+steps:
+  - name: 'Install deps and bincraft'
+    image: "reg.devxy.io/rpkgs/build-env-${OS}:${OS_VERSION}"
+    pull: true
+    environment:
+      REPO_RO_TOKEN:
+        from_secret: REPO_RO_TOKEN
+      GITHUB_PAT:
+        from_secret: GITHUB_PAT
+      B2_S3_ACCESS_KEY:
+        from_secret: B2_S3_ACCESS_KEY
+      B2_S3_SECRET_KEY:
+        from_secret: B2_S3_SECRET_KEY
+      PGPASS:
+        from_secret: PGPASS
+      R_PKG_CACHE_DIR: /mnt/cache/pkgcache
+      R_LIBS_USER: /mnt/cache/R-pkgs
+      CCACHE_DIR: /mnt/cache/ccache
+    volumes:
+      - ${ARCH}-binaries-r-dep-cache-${OS}-${OS_VERSION//./}:/mnt/cache
+    commands:
+      # one-time full wipe to fix corrupted .so files from previous failed builds
+      # - rm -rf /mnt/cache/R-pkgs
+      - mkdir -p /mnt/cache/pkgcache /mnt/cache/R-pkgs /mnt/cache/ccache /mnt/cache/packages
+      - git clone -q https://pat-s:$$REPO_RO_TOKEN@git.devxy.io/devxy/build-cran-binaries.git .
+      - git clone -q https://codefloe.com/rpkgs/bincraft.git /tmp/bincraft
+      - /opt/R/$R_VERSION/bin/R -q -e 'pak::sysreqs_db_update(); pak::local_install("/tmp/bincraft"); pak::pak(c("RPostgres", "s3fs", "data.table", "future")); packageVersion("bincraft")'
+      - /opt/R/$R_VERSION/bin/R -q -e "source('local/packages-to-build.R'); saveRDS(pkgs, '/mnt/cache/packages/pkgs_to_build.rds'); sprintf('Precomputed %s package versions to build', nrow(pkgs))"
+    backend_options:
+      docker:
+        resources:
+          requests:
+            memory: 5Gi
+            cpu: 1000m
+      kubernetes:
+        resources:
+          requests:
+            memory: 5Gi
+            cpu: 1000m
+        nodeSelector:
+          kubernetes.io/arch: ${ARCH}
+          node.kubernetes.io/instance-type: ${K8S_INSTANCE_TYPE}
+        tolerations:
+          - key: 'CI'
+            operator: 'Equal'
+            value: 'true'
+            effect: 'NoSchedule'
--- a/.crow/build-all-versions-install-deps-arm64.yaml
+++ b/.crow/build-all-versions-install-deps-arm64.yaml
@ -0,0 +1,56 @@
+when:
+  - event: manual
+    evaluate: 'task == "build-all-arm64"'
+
+skip_clone: true
+
+labels:
+  agent: gaia
+
+steps:
+  - name: 'Install deps and bincraft'
+    image: "reg.devxy.io/rpkgs/build-env-${OS}:${OS_VERSION}"
+    pull: true
+    environment:
+      REPO_RO_TOKEN:
+        from_secret: REPO_RO_TOKEN
+      GITHUB_PAT:
+        from_secret: GITHUB_PAT
+      B2_S3_ACCESS_KEY:
+        from_secret: B2_S3_ACCESS_KEY
+      B2_S3_SECRET_KEY:
+        from_secret: B2_S3_SECRET_KEY
+      PGPASS:
+        from_secret: PGPASS
+      R_PKG_CACHE_DIR: /mnt/cache/pkgcache
+      R_LIBS_USER: /mnt/cache/R-pkgs
+      CCACHE_DIR: /mnt/cache/ccache
+    volumes:
+      - ${ARCH}-binaries-r-dep-cache-${OS}-${OS_VERSION//./}:/mnt/cache
+    commands:
+      # one-time full wipe to fix corrupted .so files from previous failed builds
+      # - rm -rf /mnt/cache/R-pkgs
+      - mkdir -p /mnt/cache/pkgcache /mnt/cache/R-pkgs /mnt/cache/ccache /mnt/cache/packages
+      - git clone -q https://pat-s:$$REPO_RO_TOKEN@git.devxy.io/devxy/build-cran-binaries.git .
+      - git clone -q https://codefloe.com/rpkgs/bincraft.git /tmp/bincraft
+      - /opt/R/$R_VERSION/bin/R -q -e 'pak::sysreqs_db_update(); pak::local_install("/tmp/bincraft"); pak::pak(c("RPostgres", "s3fs", "data.table", "future")); packageVersion("bincraft")'
+      - /opt/R/$R_VERSION/bin/R -q -e "source('local/packages-to-build.R'); saveRDS(pkgs, '/mnt/cache/packages/pkgs_to_build.rds'); sprintf('Precomputed %s package versions to build', nrow(pkgs))"
+    backend_options:
+      docker:
+        resources:
+          requests:
+            memory: 5Gi
+            cpu: 1000m
+      kubernetes:
+        resources:
+          requests:
+            memory: 5Gi
+            cpu: 1000m
+        nodeSelector:
+          kubernetes.io/arch: ${ARCH}
+          node.kubernetes.io/instance-type: ${K8S_INSTANCE_TYPE}
+        tolerations:
+          - key: 'CI'
+            operator: 'Equal'
+            value: 'true'
+            effect: 'NoSchedule'
--- a/.crow/build-all-versions-install-deps.yaml
+++ b/.crow/build-all-versions-install-deps.yaml
@ -1,97 +0,0 @@
-# Consolidated install-deps for build-all (both arches in one file).
-# Triggered together with build-all-versions; `target_arch` routes the matrix.
-# Variables are declared so the manual-run form exposes them (crow #1165);
-# they are merged with build-all-versions' identical declarations.
-variables:
-  # Gates this pipeline. A manual pipeline creation instantiates every file in
-  # .crow/, and a declared default is applied even when the run never passed
-  # this variable, so the default must be a value that matches no matrix row.
-  target_arch:
-    description: 'Architecture to build, or "none" to run nothing.'
-    options:
-      - none
-      - amd64
-      - arm64
-    default: none
-  OS:
-    description: 'Base OS image name.'
-    options:
-      - alpine
-      - redhat
-      - ubuntu
-    default: alpine
-  OS_VERSION:
-    description: 'OS image tag. Must match OS (alpine: 3.24; redhat: 8/9/10; ubuntu: jammy/noble).'
-    options:
-      - '3.24'
-      - '8'
-      - '9'
-      - '10'
-      - 'jammy'
-      - 'noble'
-    default: '3.24'
-  R_VERSION:
-    description: 'Primary R version under /opt/R.'
-    options:
-      - 4.5.3
-      - 4.4.3
-    default: 4.5.3
-
-when:
-  - event: manual
-    evaluate: 'target_arch == "${ARCH}"'
-
-skip_clone: true
-
-labels:
-  platform: linux/${ARCH}
-  group: rpkgs-${ARCH}
-
-matrix:
-  include:
-    - ARCH: amd64
-    - ARCH: arm64
-
-steps:
-  - name: 'Install deps and bincraft'
-    image: 'reg.devxy.io/rpkgs/build-env-${OS}:${OS_VERSION}'
-    pull: true
-    environment:
-      OTEL_R_TRACES_EXPORTER: none
-      OTEL_R_LOGS_EXPORTER: none
-      OTEL_R_METRICS_EXPORTER: none
-      REPO_RO_TOKEN:
-        from_secret: REPO_RO_TOKEN
-      GITHUB_PAT:
-        from_secret: GITHUB_PAT
-      B2_S3_ACCESS_KEY:
-        from_secret: B2_S3_ACCESS_KEY
-      B2_S3_SECRET_KEY:
-        from_secret: B2_S3_SECRET_KEY
-      PGPASS:
-        from_secret: PGPASS
-      R_LIBS_USER: /mnt/cache/R-pkgs
-      # Keep uvr's downloads and extracted-package entries on the persistent
-      # volume instead of the container-local ~/.uvr default.
-      UVR_CACHE_DIR: /mnt/cache/uvr/cache
-      UVR_PACKAGES_DIR: /mnt/cache/uvr/packages
-      CCACHE_DIR: /mnt/cache/ccache
-    volumes:
-      - ${ARCH}-binaries-r-dep-cache-${OS}-${OS_VERSION//./}:/mnt/cache
-    commands:
-      # one-time full wipe to fix corrupted .so files from previous failed builds
-      # - rm -rf /mnt/cache/R-pkgs
-      - mkdir -p /mnt/cache/uvr/cache /mnt/cache/uvr/packages /mnt/cache/R-pkgs /mnt/cache/ccache /mnt/cache/packages
-      - git clone -q https://pat-s:$$REPO_RO_TOKEN@git.devxy.io/devxy/build-cran-binaries.git .
-      # Pin the same bincraft version the build steps use, so the precomputed
-      # snapshot and the per-agent library stay consistent across the pipeline.
-      - /opt/R/$R_VERSION/bin/Rscript local/install-bincraft.R
-      - UVR_R_BIN=/opt/R/$R_VERSION/bin/R local/uvr-install.sh RPostgres s3fs data.table future jsonlite
-      - /opt/R/$R_VERSION/bin/R -q -e 'packageVersion("bincraft")'
-      - /opt/R/$R_VERSION/bin/R -q -e "source('local/packages-to-build.R'); saveRDS(pkgs, '/mnt/cache/packages/pkgs_to_build.rds'); saveRDS(pkgs[r_minor_sensitive == TRUE], '/mnt/cache/packages/r_minor_sensitive_pkgs.rds'); sprintf('Precomputed %s package versions (%s r-minor-sensitive)', nrow(pkgs), nrow(pkgs[r_minor_sensitive == TRUE]))"
-    backend_options:
-      docker:
-        resources:
-          requests:
-            memory: 5Gi
-            cpu: 1000m
--- a/.crow/build-all-versions.yaml
+++ b/.crow/build-all-versions.yaml
@ -1,215 +0,0 @@
-### Manual full rebuild of all CRAN binaries for one OS/arch.
-# Set the variables below in the manual-run form (or via --var on the CLI).
-# `target_arch` routes the matrix; OS/OS_VERSION/R_VERSION select the platform
-# image and cache volume. Placement is via the group label (rpkgs-amd64/rpkgs-arm64).
-# Skip list lives in local/excluded-packages.json (read by local/build-all.R).
-variables:
-  # Gates this pipeline. A manual pipeline creation instantiates every file in
-  # .crow/, and a declared default is applied even when the run never passed
-  # this variable, so the default must be a value that matches no matrix row.
-  target_arch:
-    description: 'Architecture to build, or "none" to run nothing.'
-    options:
-      - none
-      - amd64
-      - arm64
-    default: none
-  OS:
-    description: 'Base OS image name.'
-    options:
-      - alpine
-      - redhat
-      - ubuntu
-    default: alpine
-  OS_VERSION:
-    description: 'OS image tag. Must match OS (alpine: 3.24; redhat: 8/9/10; ubuntu: jammy/noble).'
-    options:
-      - '3.23'
-      - '3.24'
-      - '8'
-      - '9'
-      - '10'
-      - 'jammy'
-      - 'noble'
-      - 'resolute'
-    default: '3.24'
-  R_VERSION:
-    # The slot's *primary* R minor: what `local/build-all.R` builds into the
-    # generic slot. The loop below already runs `--sensitive-only` for every
-    # other installed minor, so filling a non-primary minor's gap needs this
-    # left alone, not changed.
-    #
-    # 4.6.0 was briefly offered here (#183) and removed: selecting it for a
-    # slot whose generic binaries are 4.5-built would publish 4.6 binaries
-    # into the generic slot and break every 4.5 client.
-    description: 'Primary R version under /opt/R.'
-    options:
-      - 4.5.3
-      - 4.4.3
-    default: 4.5.3
-
-when:
-  - event: manual
-    evaluate: 'target_arch == "${ARCH}"'
-
-skip_clone: true
-
-labels:
-  platform: linux/${ARCH}
-  group: rpkgs-${ARCH}
-
-# Empty UVR_CACHE_DIR/UVR_PACKAGES_DIR fall back to uvr's container-local
-# ~/.uvr defaults; amd64 deliberately does not persist them (as with the
-# pkgcache dir it replaces), arm64 does.
-matrix:
-  include:
-    - ARCH: amd64
-      UVR_CACHE_DIR: ''
-      UVR_PACKAGES_DIR: ''
-      SPLIT_INTO: 4
-      SPLIT_INDEX: 1
-    - ARCH: amd64
-      UVR_CACHE_DIR: ''
-      UVR_PACKAGES_DIR: ''
-      SPLIT_INTO: 4
-      SPLIT_INDEX: 2
-    - ARCH: amd64
-      UVR_CACHE_DIR: ''
-      UVR_PACKAGES_DIR: ''
-      SPLIT_INTO: 4
-      SPLIT_INDEX: 3
-    - ARCH: amd64
-      UVR_CACHE_DIR: ''
-      UVR_PACKAGES_DIR: ''
-      SPLIT_INTO: 4
-      SPLIT_INDEX: 4
-    - ARCH: arm64
-      UVR_CACHE_DIR: /mnt/cache/uvr/cache
-      UVR_PACKAGES_DIR: /mnt/cache/uvr/packages
-      SPLIT_INTO: 4
-      SPLIT_INDEX: 1
-    - ARCH: arm64
-      UVR_CACHE_DIR: /mnt/cache/uvr/cache
-      UVR_PACKAGES_DIR: /mnt/cache/uvr/packages
-      SPLIT_INTO: 4
-      SPLIT_INDEX: 2
-    - ARCH: arm64
-      UVR_CACHE_DIR: /mnt/cache/uvr/cache
-      UVR_PACKAGES_DIR: /mnt/cache/uvr/packages
-      SPLIT_INTO: 4
-      SPLIT_INDEX: 3
-    - ARCH: arm64
-      UVR_CACHE_DIR: /mnt/cache/uvr/cache
-      UVR_PACKAGES_DIR: /mnt/cache/uvr/packages
-      SPLIT_INTO: 4
-      SPLIT_INDEX: 4
-
-depends_on:
-  - build-all-versions-install-deps
-
-steps:
-  - name: 'Build binaries'
-    image: 'reg.devxy.io/rpkgs/build-env-${OS}:${OS_VERSION}'
-    pull: true
-    environment:
-      OTEL_R_TRACES_EXPORTER: none
-      OTEL_R_LOGS_EXPORTER: none
-      OTEL_R_METRICS_EXPORTER: none
-      RED_HAT_DEV_PW:
-        from_secret: RED_HAT_DEV_PW
-      B2_S3_ACCESS_KEY:
-        from_secret: B2_S3_ACCESS_KEY
-      B2_S3_SECRET_KEY:
-        from_secret: B2_S3_SECRET_KEY
-      PGPASS:
-        from_secret: PGPASS
-      REPO_RO_TOKEN:
-        from_secret: REPO_RO_TOKEN
-      GITHUB_PAT:
-        from_secret: GITHUB_PAT
-      # normal env vars
-      GIT_USER: pat-s
-      # set the location of uvr's caches, which persist the R package
-      # dependencies needed to install the packages themselves
-      UVR_CACHE_DIR: ${UVR_CACHE_DIR}
-      UVR_PACKAGES_DIR: ${UVR_PACKAGES_DIR}
-      R_LIBS_USER: /mnt/cache/R-pkgs
-      CCACHE_DIR: /mnt/cache/ccache
-      NCPUS: 2
-    volumes:
-      - ${ARCH}-binaries-r-dep-cache-${OS}-${OS_VERSION//./}:/mnt/cache
-    commands:
-      - git clone -q https://pat-s:$$REPO_RO_TOKEN@git.devxy.io/devxy/build-cran-binaries.git .
-      - mkdir -p /mnt/cache/uvr/cache /mnt/cache/uvr/packages /mnt/cache/R-pkgs /mnt/cache/ccache /mnt/cache/packages
-      # The primary pass must not rely on build-all-versions-install-deps having
-      # run on *this* agent: depends_on only orders the steps, but the cache
-      # volume is per-agent, so a job landing on an agent where install-deps did
-      # not run would otherwise use a stale bincraft (which resolves `platform`
-      # to a zero-length value and breaks every metadata query and the sysdeps
-      # install). Pin bincraft here, exactly like the R-minor pass below.
-      - rm -rf /mnt/cache/R-pkgs/00LOCK-*
-      - /opt/R/$R_VERSION/bin/Rscript local/install-bincraft.R
-      # The dependency-prep job may run on another agent whose cache volume is
-      # not visible here. Install the packages needed to recompute the snapshot
-      # and query build metadata in every build job.
-      - UVR_R_BIN=/opt/R/$R_VERSION/bin/R local/uvr-install.sh RPostgres s3fs data.table future jsonlite
-      - XVFB=$(command -v xwfb-run 2>/dev/null || command -v xvfb-run); XVFB_ARGS="-a"; if command -v xwfb-run >/dev/null 2>&1; then dnf install -y -q weston 2>/dev/null; XVFB_ARGS="-c weston"; fi
-      - $XVFB $XVFB_ARGS -n $SPLIT_INDEX -- /opt/R/$R_VERSION/bin/Rscript local/build-all.R $SPLIT_INTO $SPLIT_INDEX $NCPUS 2>&1
-      - |
-        PRIMARY_MINOR=$(echo "$R_VERSION" | cut -d. -f1-2)
-        for RBIN in /opt/R/[0-9]*/bin/R; do
-          RV=$(basename "$(dirname "$(dirname "$RBIN")")")
-          RMINOR=$(echo "$RV" | cut -d. -f1-2)
-          [ "$RMINOR" = "$PRIMARY_MINOR" ] && continue
-          echo "=== R-minor-sensitive pass under R $RV ==="
-          LIB="/mnt/cache/R-pkgs-$RMINOR"
-          mkdir -p "$LIB"
-          R_LIBS_USER="$LIB" "$(dirname "$RBIN")/Rscript" local/install-bincraft.R || true
-          R_LIBS_USER="$LIB" UVR_R_BIN="$RBIN" local/uvr-install.sh RPostgres || true
-          R_LIBS_USER="$LIB" $XVFB $XVFB_ARGS -n $SPLIT_INDEX -- "$(dirname "$RBIN")/Rscript" local/build-all.R --sensitive-only $SPLIT_INTO $SPLIT_INDEX $NCPUS 2>&1 || true
-          # Also build current packages whose required dependency tree needs a newer R.
-          R_LIBS_USER="$LIB" $XVFB $XVFB_ARGS -n $SPLIT_INDEX -- "$(dirname "$RBIN")/Rscript" local/build-newer-r.R "$R_VERSION" $SPLIT_INTO $SPLIT_INDEX
-        done
-      # archive missed packages; first arg is the codename (e.g. "alpine324"),
-      # derived via bincraft like the upload step, not paste(OS, OS_VERSION).
-      - /opt/R/$R_VERSION/bin/R -q -e "bincraft::process_unarchived_pkgs(bincraft::set_codename(NULL), Sys.getenv('ARCH'), s3_endpoint = 'https://s3.eu-central-003.backblazeb2.com', s3_region = 'eu-central-003', s3_bucket = 'devxy-rpkgs-binaries', s3_access_key_id = Sys.getenv('B2_S3_ACCESS_KEY'), s3_secret_access_key = Sys.getenv('B2_S3_SECRET_KEY'), workers = $NCPUS)"
-    backend_options:
-      docker:
-        resources:
-          requests:
-            memory: 5Gi
-            cpu: 1000m
-          limits:
-            memory: 20Gi
-            cpu: 2000m
-  - name: 'Upload package indexes'
-    image: 'reg.devxy.io/rpkgs/build-env-${OS}:${OS_VERSION}'
-    pull: true
-    environment:
-      OTEL_R_TRACES_EXPORTER: none
-      OTEL_R_LOGS_EXPORTER: none
-      OTEL_R_METRICS_EXPORTER: none
-      B2_S3_ACCESS_KEY:
-        from_secret: B2_S3_ACCESS_KEY
-      B2_S3_SECRET_KEY:
-        from_secret: B2_S3_SECRET_KEY
-      R_LIBS_USER: /mnt/cache/R-pkgs
-    volumes:
-      - ${ARCH}-binaries-r-dep-cache-${OS}-${OS_VERSION//./}:/mnt/cache
-    commands:
-      - |
-        CODENAME=$(/opt/R/$R_VERSION/bin/Rscript -e "cat(bincraft::set_codename(NULL))")
-        /opt/R/$R_VERSION/bin/R -q -e "bincraft::upload_package_index(codename = '$CODENAME', s3_endpoint = 'https://s3.eu-central-003.backblazeb2.com', s3_region = 'eu-central-003', s3_bucket = 'devxy-rpkgs-binaries', s3_access_key_id = Sys.getenv('B2_S3_ACCESS_KEY'), s3_secret_access_key = Sys.getenv('B2_S3_SECRET_KEY'))"
-        for RBIN in /opt/R/[0-9]*/bin/R; do
-          RMINOR=$(basename "$(dirname "$(dirname "$RBIN")")" | cut -d. -f1-2)
-          /opt/R/$R_VERSION/bin/R -q -e "bincraft::upload_package_index(codename = '$CODENAME', r_minor = '$RMINOR', s3_endpoint = 'https://s3.eu-central-003.backblazeb2.com', s3_region = 'eu-central-003', s3_bucket = 'devxy-rpkgs-binaries', s3_access_key_id = Sys.getenv('B2_S3_ACCESS_KEY'), s3_secret_access_key = Sys.getenv('B2_S3_SECRET_KEY'))" || true
-        done
-    backend_options:
-      docker:
-        resources:
-          requests:
-            memory: 5Gi
-            cpu: 1000m
-          limits:
-            memory: 20Gi
-            cpu: 2000m
--- a/.crow/build-r-minor-sensitive-packages.yaml
+++ b/.crow/build-r-minor-sensitive-packages.yaml
@ -0,0 +1,80 @@
+when:
+  - event: manual
+    evaluate: 'build == "r-minor"'
+#   - event: manual
+#     evaluate: 'build == "alpine-322-arm64"'
+#   - event: manual
+#     evaluate: 'build == "alpine-322-arm64-1"'
+#   - event: manual
+#     evaluate: 'build == "all-arm64"'
+
+# skip_clone: true
+
+# depends_on:
+#   - alpine-322-arm64-install-deps
+
+matrix:
+  include:
+    - os: alpine
+      os_version: 3.21
+      r_version: 4.5.3
+    - os: alpine
+      os_version: 3.21
+      r_version: 4.4.3
+    # - os: alpine
+    #   os_version: 3.21
+    #   r_version: 4.3
+steps:
+  - name: 'Build R-minor-sensitive binaries'
+    image: "docker.io/devxygmbh/rpkgs-build-env-${os}:${os_version}"
+    pull: true
+    environment:
+      RED_HAT_DEV_PW:
+        from_secret: RED_HAT_DEV_PW
+      B2_S3_ACCESS_KEY:
+        from_secret: B2_S3_ACCESS_KEY
+      B2_S3_SECRET_KEY:
+        from_secret: B2_S3_SECRET_KEY
+      PGPASS:
+        from_secret: PGPASS
+      REPO_RO_TOKEN:
+        from_secret: REPO_RO_TOKEN
+      GITHUB_PAT:
+        from_secret: GITHUB_PAT
+      # normal env vars
+      GIT_USER: pat-s
+      NTFY_SERVER:
+        from_secret: NTFY_SERVER
+      NTFY_TOPIC:
+        from_secret: NTFY_TOPIC
+      NTFY_AUTH: TRUE
+      NTFY_PASSWORD:
+        from_secret: ntfy_token
+      # set the location of the 'pkgcache' cache dir which persists the R package dependencies needed to install the packages themselves
+      R_PKG_CACHE_DIR: /mnt/cache/pkgcache
+      R_LIBS_USER: /tmp/R-libs:/mnt/cache/R-pkgs
+      CCACHE_DIR: /mnt/cache/ccache
+      NCPUS: 2
+      STRATEGY: sequential
+    commands:
+      - git clone -q https://pat-s:$$REPO_RO_TOKEN@git.devxy.io/devxy/build-cran-binaries.git .
+      - rm -rf /mnt/cache/R-pkgs/00LOCK-*
+      - mkdir -p /tmp/R-libs
+      - git clone -q https://codefloe.com/rpkgs/bincraft.git /tmp/bincraft && /opt/R/$R_VERSION/bin/R CMD INSTALL --library=/tmp/R-libs /tmp/bincraft && /opt/R/$R_VERSION/bin/R -q -e 'packageVersion("bincraft")'
+      - mkdir -p /mnt/cache/pkgcache /mnt/cache/R-pkgs /mnt/cache/ccache /mnt/cache/packages
+      - XVFB=$(command -v xwfb-run 2>/dev/null || command -v xvfb-run)
+      - $XVFB -- /opt/R/$R_VERSION/bin/R -q -e "options(crayon.enabled = TRUE, Ncpus = $NCPUS, future.globals.onReference = NULL); pak::sysreqs_db_update(); pkgs = bincraft::get_r_minor_sensitive_packages(r_minor_packages_issue_url = 'https://git.devxy.io/api/v1/repos/devxy/build-cran-binaries/issues/29'); foo = lapply(pkgs, function(x) bincraft::build_binary_package(x, is_debug = FALSE, is_r_minor_sensitive = TRUE, force = FALSE, s3_endpoint = 'https://s3.eu-central-003.backblazeb2.com', s3_region = 'eu-central-003', s3_bucket = 'devxy-rpkgs-binaries', s3_access_key_id = Sys.getenv('B2_S3_ACCESS_KEY'), s3_secret_access_key = Sys.getenv('B2_S3_SECRET_KEY'), metadata_db_host = 'r-binaries.devxy.io', metadata_db_name = 'build_metadata', metadata_db_table = 'single_builds', metadata_db_user = 'rpkgs', metadata_db_password = Sys.getenv('PGPASS'), metadata_db_sslmode = 'require', metadata_db_port = 15432, archive = TRUE, upload = TRUE, store_build_metadata = TRUE))" 2>&1
+    backend_options:
+      kubernetes:
+        resources:
+          requests:
+            memory: 5Gi
+            cpu: 1000m
+          limits:
+            memory: 20Gi
+            cpu: 2000m
+        tolerations:
+          - key: 'CI'
+            operator: 'Equal'
+            value: 'true'
+            effect: 'NoSchedule'
--- a/.crow/process-updates-alpine-322-amd64.yaml
+++ b/.crow/process-updates-alpine-322-amd64.yaml
@ -0,0 +1,91 @@
+when:
+  - event: [cron]
+    cron: process-cran-updates-alpine-322-amd64
+  - event: manual
+    evaluate: 'process_cran_updates == "all"'
+  - event: manual
+    evaluate: 'process_cran_updates == "alpine-322-amd64"'
+
+skip_clone: true
+
+labels:
+  agent: artemis
+
+steps:
+  - name: 'Processing Updates'
+    image: reg.devxy.io/rpkgs/build-env-alpine:3.22
+    pull: true
+    environment:
+      RED_HAT_DEV_PW:
+        from_secret: RED_HAT_DEV_PW
+      B2_S3_ACCESS_KEY:
+        from_secret: B2_S3_ACCESS_KEY
+      B2_S3_SECRET_KEY:
+        from_secret: B2_S3_SECRET_KEY
+      PGPASS:
+        from_secret: PGPASS
+      REPO_RO_TOKEN:
+        from_secret: REPO_RO_TOKEN
+      GITHUB_PAT:
+        from_secret: GITHUB_PAT
+      # normal env vars
+      GIT_USER: pat-s
+      NTFY_SERVER:
+        from_secret: NTFY_SERVER
+      NTFY_TOPIC:
+        from_secret: NTFY_TOPIC
+      NTFY_AUTH: TRUE
+      NTFY_PASSWORD:
+        from_secret: ntfy_token
+      # set the location of the 'pkgcache' cache dir which persists the R package dependencies needed to install the packages themselves
+      R_PKG_CACHE_DIR: /mnt/cache/pkgcache
+      R_LIBS_USER: /mnt/cache/R-pkgs
+      R_VERSION: 4.5.3
+      CCACHE_DIR: /mnt/cache/ccache
+      PLATFORM: alpine-322
+      ARCH: amd64
+      NCPUS: 2
+      STRATEGY: sequential
+      INTERVAL: lubridate::interval(lubridate::today() - 6, lubridate::today() - 3)
+    # volumes:
+    #   - amd64-binaries-r-dep-cache-alpine-322:/mnt/cache
+    commands:
+      - git clone -q https://pat-s:$$REPO_RO_TOKEN@git.devxy.io/devxy/build-cran-binaries.git .
+      - rm -rf /mnt/cache/R-pkgs/00LOCK-r-pkg-binaries /mnt/cache/R-pkgs/00LOCK-bincraft /mnt/cache/R-pkgs/00LOCK-pak /mnt/cache/pkgcache/R/pkgcache /mnt/cache/pkgcache/R/pkgcache /mnt/cache/R-pkgs/pkgcache /mnt/cache/R-pkgs/00LOCK-pak/mnt/cache/R-pkgs/00LOCK-RPostgres /mnt/cache/R-pkgs/bincraft
+      - /opt/R/$R_VERSION/bin/R -q -e 'if (!requireNamespace("bincraft", quietly = TRUE) || packageVersion("bincraft") != "4.1.0") pak::pak("git::https://codefloe.com/rpkgs/bincraft.git@v4.1.0")'
+      - /opt/R/$R_VERSION/bin/R -q -e 'packageVersion("bincraft")'
+      - mkdir -p /mnt/cache/pkgcache /mnt/cache/R-pkgs /mnt/cache/ccache /mnt/cache/packages
+      # options(future.globals.onReference = NULL): for some reason s3fs::file_delete() throws 'Error: Detected a non-exportable reference ('externalptr') in one of the globals ('FUN' of class 'function') used in the future expression' otherwise
+      - xvfb-run /opt/R/$R_VERSION/bin/R -q -e "options(crayon.enabled = TRUE, Ncpus = 4, future.globals.onReference = 'error', repos = structure(c(getOption('repos'),INLA='https://inla.r-inla-download.org/R/stable'))); progressr::handlers('cli'); progressr::handlers(global = TRUE); options(future.globals.onReference = NULL); bincraft::process_cran_updates(interval = $INTERVAL, platform = 'alpine-322', process_updated = TRUE, process_new = FALSE, process_removed = TRUE, s3_endpoint = 'https://s3.eu-central-003.backblazeb2.com', s3_region = 'eu-central-003', s3_bucket = 'devxy-rpkgs-binaries', s3_access_key_id = Sys.getenv('B2_S3_ACCESS_KEY'), s3_secret_access_key = Sys.getenv('B2_S3_SECRET_KEY'), metadata_db_host = 'r-binaries.devxy.io', metadata_db_name = 'build_metadata', metadata_db_table = 'single_builds', metadata_db_user = 'rpkgs', metadata_db_password = Sys.getenv('PGPASS'), metadata_db_sslmode = 'require', metadata_db_port = 15432, archive = TRUE, upload = TRUE, store_build_metadata = TRUE)"
+      - /opt/R/$R_VERSION/bin/R -q -e 'library(bincraft); upload_package_index(codename = "alpine322", s3_endpoint = "https://s3.eu-central-003.backblazeb2.com", s3_region = "eu-central-003", s3_bucket = "devxy-rpkgs-binaries", s3_access_key_id = Sys.getenv("B2_S3_ACCESS_KEY"), s3_secret_access_key = Sys.getenv("B2_S3_SECRET_KEY"))'
+    backend_options:
+      kubernetes:
+        resources:
+          requests:
+            memory: 5Gi
+            cpu: 3000m
+          limits:
+            memory: 18Gi
+            cpu: 3000m
+        nodeSelector:
+          kubernetes.io/arch: amd64
+          node.kubernetes.io/instance-type: AX42
+        tolerations:
+          - key: 'CI'
+            operator: 'Equal'
+            value: 'true'
+            effect: 'NoSchedule'
+
+  - name: Purge CDN cache
+    image: reg.devxy.io/docker.io/library/alpine:3.23
+    environment:
+      BUNNYNET_API_KEY:
+        from_secret: BUNNYNET_API_KEY
+      SUBDOMAIN1: 'cran.devxy.io'
+      SUBDOMAIN2: 'cran.allianceswisspass.devxy.io'
+      SUBDOMAIN3: 'cran.rpkgs.com'
+      OS_ID: alpine322
+      ARCH: amd64
+    commands:
+      - apk add --no-cache -q bash curl
+      - bash scripts/purge_cdn_cache.sh "$BUNNYNET_API_KEY" "$ARCH" "$OS_ID" "$SUBDOMAIN1" "$SUBDOMAIN2" "$SUBDOMAIN3"
--- a/.crow/process-updates-alpine-322-arm64.yaml
+++ b/.crow/process-updates-alpine-322-arm64.yaml
@ -0,0 +1,73 @@
+when:
+  - event: [cron]
+    cron: process-cran-updates-alpine-322-arm64
+  - event: manual
+    evaluate: 'process_cran_updates == "all"'
+  - event: manual
+    evaluate: 'process_cran_updates == "alpine-322-arm64"'
+
+skip_clone: true
+
+labels:
+  agent: gaia
+
+steps:
+  - name: 'Processing Updates'
+    image: reg.devxy.io/rpkgs/build-env-alpine:3.22
+    pull: true
+    environment:
+      RED_HAT_DEV_PW:
+        from_secret: RED_HAT_DEV_PW
+      B2_S3_ACCESS_KEY:
+        from_secret: B2_S3_ACCESS_KEY
+      B2_S3_SECRET_KEY:
+        from_secret: B2_S3_SECRET_KEY
+      PGPASS:
+        from_secret: PGPASS
+      REPO_RO_TOKEN:
+        from_secret: REPO_RO_TOKEN
+      GITHUB_PAT:
+        from_secret: GITHUB_PAT
+      # normal env vars
+      GIT_USER: pat-s
+      NTFY_SERVER:
+        from_secret: NTFY_SERVER
+      NTFY_TOPIC:
+        from_secret: NTFY_TOPIC
+      NTFY_AUTH: TRUE
+      NTFY_PASSWORD:
+        from_secret: ntfy_token
+      # set the location of the 'pkgcache' cache dir which persists the R package dependencies needed to install the packages themselves
+      R_PKG_CACHE_DIR: /mnt/cache/pkgcache
+      R_LIBS_USER: /mnt/cache/R-pkgs
+      R_VERSION: 4.5.3
+      CCACHE_DIR: /mnt/cache/ccache
+      PLATFORM: alpine-322
+      ARCH: arm64
+      NCPUS: 2
+      INTERVAL: lubridate::interval(lubridate::today() - 6, lubridate::today() - 3)
+    # volumes:
+    #   - arm64-binaries-r-dep-cache-alpine-321:/mnt/cache
+    commands:
+      - git clone -q https://pat-s:$$REPO_RO_TOKEN@git.devxy.io/devxy/build-cran-binaries.git .
+      - rm -rf /mnt/cache/R-pkgs/00LOCK-r-pkg-binaries /mnt/cache/R-pkgs/00LOCK-bincraft /mnt/cache/R-pkgs/00LOCK-pak /mnt/cache/pkgcache/R/pkgcache /mnt/cache/pkgcache/R/pkgcache /mnt/cache/R-pkgs/pkgcache /mnt/cache/R-pkgs/00LOCK-pak/mnt/cache/R-pkgs/00LOCK-RPostgres /mnt/cache/R-pkgs/bincraft
+      - /opt/R/$R_VERSION/bin/R -q -e 'if (!requireNamespace("bincraft", quietly = TRUE) || packageVersion("bincraft") != "4.1.0") pak::pak("git::https://codefloe.com/rpkgs/bincraft.git@v4.1.0")'
+      - /opt/R/$R_VERSION/bin/R -q -e 'packageVersion("bincraft")'
+      - mkdir -p /mnt/cache/pkgcache /mnt/cache/R-pkgs /mnt/cache/ccache /mnt/cache/packages
+      # options(future.globals.onReference = NULL): for some reason s3fs::file_delete() throws 'Error: Detected a non-exportable reference ('externalptr') in one of the globals ('FUN' of class 'function') used in the future expression' otherwise
+      - xvfb-run /opt/R/$R_VERSION/bin/R -q -e "options(crayon.enabled = TRUE, Ncpus = 4, future.globals.onReference = 'error', repos = structure(c(getOption('repos'),INLA='https://inla.r-inla-download.org/R/stable'))); progressr::handlers('cli'); progressr::handlers(global = TRUE); options(future.globals.onReference = NULL); bincraft::process_cran_updates(interval = $INTERVAL, platform = 'alpine-322', process_updated = TRUE, process_new = TRUE, process_removed = TRUE, s3_endpoint = 'https://s3.eu-central-003.backblazeb2.com', s3_region = 'eu-central-003', s3_bucket = 'devxy-rpkgs-binaries', s3_access_key_id = Sys.getenv('B2_S3_ACCESS_KEY'), s3_secret_access_key = Sys.getenv('B2_S3_SECRET_KEY'), metadata_db_host = 'r-binaries.devxy.io', metadata_db_name = 'build_metadata', metadata_db_table = 'single_builds', metadata_db_user = 'rpkgs', metadata_db_password = Sys.getenv('PGPASS'), metadata_db_sslmode = 'require', metadata_db_port = 15432, archive = TRUE, upload = TRUE, store_build_metadata = TRUE)"
+      - /opt/R/$R_VERSION/bin/R -q -e 'library(bincraft); upload_package_index(codename = "alpine322", s3_endpoint = "https://s3.eu-central-003.backblazeb2.com", s3_region = "eu-central-003", s3_bucket = "devxy-rpkgs-binaries", s3_access_key_id = Sys.getenv("B2_S3_ACCESS_KEY"), s3_secret_access_key = Sys.getenv("B2_S3_SECRET_KEY"))'
+
+  - name: Purge CDN cache
+    image: reg.devxy.io/docker.io/library/alpine:3.23
+    environment:
+      BUNNYNET_API_KEY:
+        from_secret: BUNNYNET_API_KEY
+      SUBDOMAIN1: 'cran.devxy.io'
+      SUBDOMAIN2: 'cran.allianceswisspass.devxy.io'
+      SUBDOMAIN3: 'cran.rpkgs.com'
+      OS_ID: alpine322
+      ARCH: arm64
+    commands:
+      - apk add --no-cache -q bash curl
+      - bash scripts/purge_cdn_cache.sh "$BUNNYNET_API_KEY" "$ARCH" "$OS_ID" "$SUBDOMAIN1" "$SUBDOMAIN2" "$SUBDOMAIN3"
--- a/.crow/process-updates-alpine-323-amd64.yaml
+++ b/.crow/process-updates-alpine-323-amd64.yaml
@ -0,0 +1,91 @@
+when:
+  - event: [cron]
+    cron: process-cran-updates-alpine-323-amd64
+  - event: manual
+    evaluate: 'process_cran_updates == "all"'
+  - event: manual
+    evaluate: 'process_cran_updates == "alpine-323-amd64"'
+
+skip_clone: true
+
+labels:
+  agent: artemis
+
+steps:
+  - name: 'Processing Updates'
+    image: reg.devxy.io/rpkgs/build-env-alpine:3.23
+    pull: true
+    environment:
+      RED_HAT_DEV_PW:
+        from_secret: RED_HAT_DEV_PW
+      B2_S3_ACCESS_KEY:
+        from_secret: B2_S3_ACCESS_KEY
+      B2_S3_SECRET_KEY:
+        from_secret: B2_S3_SECRET_KEY
+      PGPASS:
+        from_secret: PGPASS
+      REPO_RO_TOKEN:
+        from_secret: REPO_RO_TOKEN
+      GITHUB_PAT:
+        from_secret: GITHUB_PAT
+      # normal env vars
+      GIT_USER: pat-s
+      NTFY_SERVER:
+        from_secret: NTFY_SERVER
+      NTFY_TOPIC:
+        from_secret: NTFY_TOPIC
+      NTFY_AUTH: TRUE
+      NTFY_PASSWORD:
+        from_secret: ntfy_token
+      # set the location of the 'pkgcache' cache dir which persists the R package dependencies needed to install the packages themselves
+      R_PKG_CACHE_DIR: /mnt/cache/pkgcache
+      R_LIBS_USER: /mnt/cache/R-pkgs
+      R_VERSION: 4.5.3
+      CCACHE_DIR: /mnt/cache/ccache
+      PLATFORM: alpine-323
+      ARCH: amd64
+      NCPUS: 2
+      STRATEGY: sequential
+      INTERVAL: lubridate::interval(lubridate::today() - 6, lubridate::today() - 3)
+    # volumes:
+    #   - amd64-binaries-r-dep-cache-alpine-323:/mnt/cache
+    commands:
+      - git clone -q https://pat-s:$$REPO_RO_TOKEN@git.devxy.io/devxy/build-cran-binaries.git .
+      - rm -rf /mnt/cache/R-pkgs/00LOCK-r-pkg-binaries /mnt/cache/R-pkgs/00LOCK-bincraft /mnt/cache/R-pkgs/00LOCK-pak /mnt/cache/pkgcache/R/pkgcache /mnt/cache/pkgcache/R/pkgcache /mnt/cache/R-pkgs/pkgcache /mnt/cache/R-pkgs/00LOCK-pak/mnt/cache/R-pkgs/00LOCK-RPostgres /mnt/cache/R-pkgs/bincraft
+      - /opt/R/$R_VERSION/bin/R -q -e 'if (!requireNamespace("bincraft", quietly = TRUE) || packageVersion("bincraft") != "4.1.0") pak::pak("git::https://codefloe.com/rpkgs/bincraft.git@v4.1.0")'
+      - /opt/R/$R_VERSION/bin/R -q -e 'packageVersion("bincraft")'
+      - mkdir -p /mnt/cache/pkgcache /mnt/cache/R-pkgs /mnt/cache/ccache /mnt/cache/packages
+      # options(future.globals.onReference = NULL): for some reason s3fs::file_delete() throws 'Error: Detected a non-exportable reference ('externalptr') in one of the globals ('FUN' of class 'function') used in the future expression' otherwise
+      - xvfb-run /opt/R/$R_VERSION/bin/R -q -e "options(crayon.enabled = TRUE, Ncpus = 4, future.globals.onReference = 'error', repos = structure(c(getOption('repos'),INLA='https://inla.r-inla-download.org/R/stable'))); progressr::handlers('cli'); progressr::handlers(global = TRUE); options(future.globals.onReference = NULL); bincraft::process_cran_updates(interval = $INTERVAL, platform = 'alpine-323', process_updated = TRUE, process_new = FALSE, process_removed = TRUE, s3_endpoint = 'https://s3.eu-central-003.backblazeb2.com', s3_region = 'eu-central-003', s3_bucket = 'devxy-rpkgs-binaries', s3_access_key_id = Sys.getenv('B2_S3_ACCESS_KEY'), s3_secret_access_key = Sys.getenv('B2_S3_SECRET_KEY'), metadata_db_host = 'r-binaries.devxy.io', metadata_db_name = 'build_metadata', metadata_db_table = 'single_builds', metadata_db_user = 'rpkgs', metadata_db_password = Sys.getenv('PGPASS'), metadata_db_sslmode = 'require', metadata_db_port = 15432, archive = TRUE, upload = TRUE, store_build_metadata = TRUE)"
+      - /opt/R/$R_VERSION/bin/R -q -e 'library(bincraft); upload_package_index(codename = "alpine323", s3_endpoint = "https://s3.eu-central-003.backblazeb2.com", s3_region = "eu-central-003", s3_bucket = "devxy-rpkgs-binaries", s3_access_key_id = Sys.getenv("B2_S3_ACCESS_KEY"), s3_secret_access_key = Sys.getenv("B2_S3_SECRET_KEY"))'
+    backend_options:
+      kubernetes:
+        resources:
+          requests:
+            memory: 5Gi
+            cpu: 3000m
+          limits:
+            memory: 18Gi
+            cpu: 3000m
+        nodeSelector:
+          kubernetes.io/arch: amd64
+          node.kubernetes.io/instance-type: AX42
+        tolerations:
+          - key: 'CI'
+            operator: 'Equal'
+            value: 'true'
+            effect: 'NoSchedule'
+
+  - name: Purge CDN cache
+    image: reg.devxy.io/docker.io/library/alpine:3.23
+    environment:
+      BUNNYNET_API_KEY:
+        from_secret: BUNNYNET_API_KEY
+      SUBDOMAIN1: 'cran.devxy.io'
+      SUBDOMAIN2: 'cran.allianceswisspass.devxy.io'
+      SUBDOMAIN3: 'cran.rpkgs.com'
+      OS_ID: alpine323
+      ARCH: amd64
+    commands:
+      - apk add --no-cache -q bash curl
+      - bash scripts/purge_cdn_cache.sh "$BUNNYNET_API_KEY" "$ARCH" "$OS_ID" "$SUBDOMAIN1" "$SUBDOMAIN2" "$SUBDOMAIN3"
--- a/.crow/process-updates-alpine-323-arm64.yaml
+++ b/.crow/process-updates-alpine-323-arm64.yaml
@ -0,0 +1,73 @@
+when:
+  - event: [cron]
+    cron: process-cran-updates-alpine-323-arm64
+  - event: manual
+    evaluate: 'process_cran_updates == "all"'
+  - event: manual
+    evaluate: 'process_cran_updates == "alpine-323-arm64"'
+
+skip_clone: true
+
+labels:
+  agent: gaia
+
+steps:
+  - name: 'Processing Updates'
+    image: reg.devxy.io/rpkgs/build-env-alpine:3.23
+    pull: true
+    environment:
+      RED_HAT_DEV_PW:
+        from_secret: RED_HAT_DEV_PW
+      B2_S3_ACCESS_KEY:
+        from_secret: B2_S3_ACCESS_KEY
+      B2_S3_SECRET_KEY:
+        from_secret: B2_S3_SECRET_KEY
+      PGPASS:
+        from_secret: PGPASS
+      REPO_RO_TOKEN:
+        from_secret: REPO_RO_TOKEN
+      GITHUB_PAT:
+        from_secret: GITHUB_PAT
+      # normal env vars
+      GIT_USER: pat-s
+      NTFY_SERVER:
+        from_secret: NTFY_SERVER
+      NTFY_TOPIC:
+        from_secret: NTFY_TOPIC
+      NTFY_AUTH: TRUE
+      NTFY_PASSWORD:
+        from_secret: ntfy_token
+      # set the location of the 'pkgcache' cache dir which persists the R package dependencies needed to install the packages themselves
+      R_PKG_CACHE_DIR: /mnt/cache/pkgcache
+      R_LIBS_USER: /mnt/cache/R-pkgs
+      R_VERSION: 4.5.3
+      CCACHE_DIR: /mnt/cache/ccache
+      PLATFORM: alpine-323
+      ARCH: arm64
+      NCPUS: 2
+      INTERVAL: lubridate::interval(lubridate::today() - 6, lubridate::today() - 3)
+    # volumes:
+    #   - arm64-binaries-r-dep-cache-alpine-321:/mnt/cache
+    commands:
+      - git clone -q https://pat-s:$$REPO_RO_TOKEN@git.devxy.io/devxy/build-cran-binaries.git .
+      - rm -rf /mnt/cache/R-pkgs/00LOCK-r-pkg-binaries /mnt/cache/R-pkgs/00LOCK-bincraft /mnt/cache/R-pkgs/00LOCK-pak /mnt/cache/pkgcache/R/pkgcache /mnt/cache/pkgcache/R/pkgcache /mnt/cache/R-pkgs/pkgcache /mnt/cache/R-pkgs/00LOCK-pak/mnt/cache/R-pkgs/00LOCK-RPostgres /mnt/cache/R-pkgs/bincraft
+      - /opt/R/$R_VERSION/bin/R -q -e 'if (!requireNamespace("bincraft", quietly = TRUE) || packageVersion("bincraft") != "4.1.0") pak::pak("git::https://codefloe.com/rpkgs/bincraft.git@v4.1.0")'
+      - /opt/R/$R_VERSION/bin/R -q -e 'packageVersion("bincraft")'
+      - mkdir -p /mnt/cache/pkgcache /mnt/cache/R-pkgs /mnt/cache/ccache /mnt/cache/packages
+      # options(future.globals.onReference = NULL): for some reason s3fs::file_delete() throws 'Error: Detected a non-exportable reference ('externalptr') in one of the globals ('FUN' of class 'function') used in the future expression' otherwise
+      - xvfb-run /opt/R/$R_VERSION/bin/R -q -e "options(crayon.enabled = TRUE, Ncpus = 4, future.globals.onReference = 'error', repos = structure(c(getOption('repos'),INLA='https://inla.r-inla-download.org/R/stable'))); progressr::handlers('cli'); progressr::handlers(global = TRUE); options(future.globals.onReference = NULL); bincraft::process_cran_updates(interval = $INTERVAL, platform = 'alpine-323', process_updated = TRUE, process_new = TRUE, process_removed = TRUE, s3_endpoint = 'https://s3.eu-central-003.backblazeb2.com', s3_region = 'eu-central-003', s3_bucket = 'devxy-rpkgs-binaries', s3_access_key_id = Sys.getenv('B2_S3_ACCESS_KEY'), s3_secret_access_key = Sys.getenv('B2_S3_SECRET_KEY'), metadata_db_host = 'r-binaries.devxy.io', metadata_db_name = 'build_metadata', metadata_db_table = 'single_builds', metadata_db_user = 'rpkgs', metadata_db_password = Sys.getenv('PGPASS'), metadata_db_sslmode = 'require', metadata_db_port = 15432, archive = TRUE, upload = TRUE, store_build_metadata = TRUE)"
+      - /opt/R/$R_VERSION/bin/R -q -e 'library(bincraft); upload_package_index(codename = "alpine323", s3_endpoint = "https://s3.eu-central-003.backblazeb2.com", s3_region = "eu-central-003", s3_bucket = "devxy-rpkgs-binaries", s3_access_key_id = Sys.getenv("B2_S3_ACCESS_KEY"), s3_secret_access_key = Sys.getenv("B2_S3_SECRET_KEY"))'
+
+  - name: Purge CDN cache
+    image: reg.devxy.io/docker.io/library/alpine:3.23
+    environment:
+      BUNNYNET_API_KEY:
+        from_secret: BUNNYNET_API_KEY
+      SUBDOMAIN1: 'cran.devxy.io'
+      SUBDOMAIN2: 'cran.allianceswisspass.devxy.io'
+      SUBDOMAIN3: 'cran.rpkgs.com'
+      OS_ID: alpine323
+      ARCH: arm64
+    commands:
+      - apk add --no-cache -q bash curl
+      - bash scripts/purge_cdn_cache.sh "$BUNNYNET_API_KEY" "$ARCH" "$OS_ID" "$SUBDOMAIN1" "$SUBDOMAIN2" "$SUBDOMAIN3"
--- a/.crow/process-updates-redhat-10-amd64.yaml
+++ b/.crow/process-updates-redhat-10-amd64.yaml
@ -0,0 +1,93 @@
+when:
+  - event: [cron]
+    cron: process-cran-updates-redhat-10-amd64
+  - event: manual
+    evaluate: 'process_cran_updates == "all"'
+  - event: manual
+    evaluate: 'process_cran_updates == "redhat-10-amd64"'
+
+skip_clone: true
+
+labels:
+  agent: artemis
+
+steps:
+  - name: 'Processing Updates'
+    image: reg.devxy.io/rpkgs/build-env-redhat:10
+    pull: true
+    environment:
+      RED_HAT_DEV_PW:
+        from_secret: RED_HAT_DEV_PW
+      B2_S3_ACCESS_KEY:
+        from_secret: B2_S3_ACCESS_KEY
+      B2_S3_SECRET_KEY:
+        from_secret: B2_S3_SECRET_KEY
+      PGPASS:
+        from_secret: PGPASS
+      REPO_RO_TOKEN:
+        from_secret: REPO_RO_TOKEN
+      GITHUB_PAT:
+        from_secret: GITHUB_PAT
+      # normal env vars
+      GIT_USER: pat-s
+      NTFY_SERVER:
+        from_secret: NTFY_SERVER
+      NTFY_TOPIC:
+        from_secret: NTFY_TOPIC
+      NTFY_AUTH: TRUE
+      NTFY_PASSWORD:
+        from_secret: ntfy_token
+      # set the location of the 'pkgcache' cache dir which persists the R package dependencies needed to install the packages themselves
+      R_PKG_CACHE_DIR: /mnt/cache/pkgcache
+      R_LIBS_USER: /mnt/cache/R-pkgs
+      R_VERSION: 4.5.3
+      CCACHE_DIR: /mnt/cache/ccache
+      PLATFORM: redhat-10
+      ARCH: amd64
+      NCPUS: 2
+      MEMORY: 18Gi
+      STRATEGY: sequential
+      INTERVAL: lubridate::interval(lubridate::today() - 6, lubridate::today() - 3)
+    # volumes:
+    #   - amd64-binaries-r-dep-cache-redhat-10:/mnt/cache
+    commands:
+      - git clone -q https://pat-s:$$REPO_RO_TOKEN@git.devxy.io/devxy/build-cran-binaries.git .
+      - rm -rf /mnt/cache/R-pkgs/00LOCK-r-pkg-binaries /mnt/cache/R-pkgs/00LOCK-bincraft /mnt/cache/R-pkgs/00LOCK-pak /mnt/cache/pkgcache/R/pkgcache /mnt/cache/pkgcache/R/pkgcache /mnt/cache/R-pkgs/pkgcache /mnt/cache/R-pkgs/00LOCK-pak/mnt/cache/R-pkgs/00LOCK-RPostgres /mnt/cache/R-pkgs/bincraft
+      - /opt/R/$R_VERSION/bin/R -q -e 'if (!requireNamespace("bincraft", quietly = TRUE) || packageVersion("bincraft") != "4.1.0") pak::pak("git::https://codefloe.com/rpkgs/bincraft.git@v4.1.0")'
+      - /opt/R/$R_VERSION/bin/R -q -e 'packageVersion("bincraft")'
+      - mkdir -p /mnt/cache/pkgcache /mnt/cache/R-pkgs /mnt/cache/ccache /mnt/cache/packages
+      # options(future.globals.onReference = NULL): for some reason s3fs::file_delete() throws 'Error: Detected a non-exportable reference ('externalptr') in one of the globals ('FUN' of class 'function') used in the future expression' otherwise
+      - XVFB=$(command -v xwfb-run 2>/dev/null || command -v xvfb-run); XVFB_ARGS=""; if command -v xwfb-run >/dev/null 2>&1; then dnf install -y -q weston 2>/dev/null; XVFB_ARGS="-c weston"; fi
+      - $XVFB $XVFB_ARGS -- /opt/R/$R_VERSION/bin/R -q -e "options(crayon.enabled = TRUE, Ncpus = 4, future.globals.onReference = 'error', repos = structure(c(getOption('repos'),INLA='https://inla.r-inla-download.org/R/stable'))); progressr::handlers('cli'); progressr::handlers(global = TRUE); options(future.globals.onReference = NULL); bincraft::process_cran_updates(interval = $INTERVAL, platform = 'redhat-10', process_updated = TRUE, process_new = TRUE, process_removed = TRUE, s3_endpoint = 'https://s3.eu-central-003.backblazeb2.com', s3_region = 'eu-central-003', s3_bucket = 'devxy-rpkgs-binaries', s3_access_key_id = Sys.getenv('B2_S3_ACCESS_KEY'), s3_secret_access_key = Sys.getenv('B2_S3_SECRET_KEY'), metadata_db_host = 'r-binaries.devxy.io', metadata_db_name = 'build_metadata', metadata_db_table = 'single_builds', metadata_db_user = 'rpkgs', metadata_db_password = Sys.getenv('PGPASS'), metadata_db_sslmode = 'require', metadata_db_port = 15432, archive = TRUE, upload = TRUE, store_build_metadata = TRUE)"
+      - /opt/R/$R_VERSION/bin/R -q -e 'library(bincraft); upload_package_index(codename = "rhel10", s3_endpoint = "https://s3.eu-central-003.backblazeb2.com", s3_region = "eu-central-003", s3_bucket = "devxy-rpkgs-binaries", s3_access_key_id = Sys.getenv("B2_S3_ACCESS_KEY"), s3_secret_access_key = Sys.getenv("B2_S3_SECRET_KEY"))'
+    backend_options:
+      kubernetes:
+        resources:
+          requests:
+            memory: 5Gi
+            cpu: 3000m
+          limits:
+            memory: 18Gi
+            cpu: 3000m
+        nodeSelector:
+          kubernetes.io/arch: amd64
+          node.kubernetes.io/instance-type: AX42
+        tolerations:
+          - key: 'CI'
+            operator: 'Equal'
+            value: 'true'
+            effect: 'NoSchedule'
+
+  - name: Purge CDN cache
+    image: reg.devxy.io/docker.io/library/alpine:3.23
+    environment:
+      BUNNYNET_API_KEY:
+        from_secret: BUNNYNET_API_KEY
+      SUBDOMAIN1: 'cran.devxy.io'
+      SUBDOMAIN2: 'cran.allianceswisspass.devxy.io'
+      SUBDOMAIN3: 'cran.rpkgs.com'
+      OS_ID: rhel10
+      ARCH: amd64
+    commands:
+      - apk add --no-cache -q bash curl
+      - bash scripts/purge_cdn_cache.sh "$BUNNYNET_API_KEY" "$ARCH" "$OS_ID" "$SUBDOMAIN1" "$SUBDOMAIN2" "$SUBDOMAIN3"
--- a/.crow/process-updates-redhat-10-arm64.yaml
+++ b/.crow/process-updates-redhat-10-arm64.yaml
@ -0,0 +1,74 @@
+when:
+  - event: [cron]
+    cron: process-cran-updates-redhat-10-arm64
+  - event: manual
+    evaluate: 'process_cran_updates == "all"'
+  - event: manual
+    evaluate: 'process_cran_updates == "redhat-10-arm64"'
+
+skip_clone: true
+
+labels:
+  agent: gaia
+
+steps:
+  - name: 'Processing Updates'
+    image: reg.devxy.io/rpkgs/build-env-redhat:10
+    pull: true
+    environment:
+      RED_HAT_DEV_PW:
+        from_secret: RED_HAT_DEV_PW
+      B2_S3_ACCESS_KEY:
+        from_secret: B2_S3_ACCESS_KEY
+      B2_S3_SECRET_KEY:
+        from_secret: B2_S3_SECRET_KEY
+      PGPASS:
+        from_secret: PGPASS
+      REPO_RO_TOKEN:
+        from_secret: REPO_RO_TOKEN
+      GITHUB_PAT:
+        from_secret: GITHUB_PAT
+      # normal env vars
+      GIT_USER: pat-s
+      NTFY_SERVER:
+        from_secret: NTFY_SERVER
+      NTFY_TOPIC:
+        from_secret: NTFY_TOPIC
+      NTFY_AUTH: TRUE
+      NTFY_PASSWORD:
+        from_secret: ntfy_token
+      # set the location of the 'pkgcache' cache dir which persists the R package dependencies needed to install the packages themselves
+      R_PKG_CACHE_DIR: /mnt/cache/pkgcache
+      R_LIBS_USER: /mnt/cache/R-pkgs
+      R_VERSION: 4.5.3
+      CCACHE_DIR: /mnt/cache/ccache
+      PLATFORM: redhat-10
+      ARCH: arm64
+      NCPUS: 2
+      INTERVAL: lubridate::interval(lubridate::today() - 6, lubridate::today() - 3)
+    # volumes:
+    #   - arm64-binaries-r-dep-cache-redhat-10:/mnt/cache
+    commands:
+      - git clone -q https://pat-s:$$REPO_RO_TOKEN@git.devxy.io/devxy/build-cran-binaries.git .
+      - rm -rf /mnt/cache/R-pkgs/00LOCK-r-pkg-binaries /mnt/cache/R-pkgs/00LOCK-bincraft /mnt/cache/R-pkgs/00LOCK-pak /mnt/cache/pkgcache/R/pkgcache /mnt/cache/pkgcache/R/pkgcache /mnt/cache/R-pkgs/pkgcache /mnt/cache/R-pkgs/00LOCK-pak/mnt/cache/R-pkgs/00LOCK-RPostgres /mnt/cache/R-pkgs/bincraft
+      - /opt/R/$R_VERSION/bin/R -q -e 'if (!requireNamespace("bincraft", quietly = TRUE) || packageVersion("bincraft") != "4.1.0") pak::pak("git::https://codefloe.com/rpkgs/bincraft.git@v4.1.0")'
+      - /opt/R/$R_VERSION/bin/R -q -e 'packageVersion("bincraft")'
+      - mkdir -p /mnt/cache/pkgcache /mnt/cache/R-pkgs /mnt/cache/ccache /mnt/cache/packages
+      # options(future.globals.onReference = NULL): for some reason s3fs::file_delete() throws 'Error: Detected a non-exportable reference ('externalptr') in one of the globals ('FUN' of class 'function') used in the future expression' otherwise
+      - XVFB=$(command -v xwfb-run 2>/dev/null || command -v xvfb-run); XVFB_ARGS=""; if command -v xwfb-run >/dev/null 2>&1; then dnf install -y -q weston 2>/dev/null; XVFB_ARGS="-c weston"; fi
+      - $XVFB $XVFB_ARGS -- /opt/R/$R_VERSION/bin/R -q -e "options(crayon.enabled = TRUE, Ncpus = 4, future.globals.onReference = 'error', repos = structure(c(getOption('repos'),INLA='https://inla.r-inla-download.org/R/stable'))); progressr::handlers('cli'); progressr::handlers(global = TRUE); options(future.globals.onReference = NULL); bincraft::process_cran_updates(interval = $INTERVAL, platform = 'redhat-10', process_updated = TRUE, process_new = TRUE, process_removed = TRUE, s3_endpoint = 'https://s3.eu-central-003.backblazeb2.com', s3_region = 'eu-central-003', s3_bucket = 'devxy-rpkgs-binaries', s3_access_key_id = Sys.getenv('B2_S3_ACCESS_KEY'), s3_secret_access_key = Sys.getenv('B2_S3_SECRET_KEY'), metadata_db_host = 'r-binaries.devxy.io', metadata_db_name = 'build_metadata', metadata_db_table = 'single_builds', metadata_db_user = 'rpkgs', metadata_db_password = Sys.getenv('PGPASS'), metadata_db_sslmode = 'require', metadata_db_port = 15432, archive = TRUE, upload = TRUE, store_build_metadata = TRUE)"
+      - /opt/R/$R_VERSION/bin/R -q -e 'library(bincraft); upload_package_index(codename = "rhel10", s3_endpoint = "https://s3.eu-central-003.backblazeb2.com", s3_region = "eu-central-003", s3_bucket = "devxy-rpkgs-binaries", s3_access_key_id = Sys.getenv("B2_S3_ACCESS_KEY"), s3_secret_access_key = Sys.getenv("B2_S3_SECRET_KEY"))'
+
+  - name: Purge CDN cache
+    image: reg.devxy.io/docker.io/library/alpine:3.23
+    environment:
+      BUNNYNET_API_KEY:
+        from_secret: BUNNYNET_API_KEY
+      SUBDOMAIN1: 'cran.devxy.io'
+      SUBDOMAIN2: 'cran.allianceswisspass.devxy.io'
+      SUBDOMAIN3: 'cran.rpkgs.com'
+      OS_ID: rhel10
+      ARCH: arm64
+    commands:
+      - apk add --no-cache -q bash curl
+      - bash scripts/purge_cdn_cache.sh "$BUNNYNET_API_KEY" "$ARCH" "$OS_ID" "$SUBDOMAIN1" "$SUBDOMAIN2" "$SUBDOMAIN3"
--- a/.crow/process-updates-redhat-8-amd64.yaml
+++ b/.crow/process-updates-redhat-8-amd64.yaml
@ -0,0 +1,91 @@
+when:
+  - event: [cron]
+    cron: process-cran-updates-redhat-8-amd64
+  - event: manual
+    evaluate: 'process_cran_updates == "all"'
+  - event: manual
+    evaluate: 'process_cran_updates == "redhat-8-amd64"'
+
+skip_clone: true
+
+labels:
+  agent: artemis
+
+steps:
+  - name: 'Processing Updates'
+    image: reg.devxy.io/rpkgs/build-env-redhat:8
+    pull: true
+    environment:
+      RED_HAT_DEV_PW:
+        from_secret: RED_HAT_DEV_PW
+      B2_S3_ACCESS_KEY:
+        from_secret: B2_S3_ACCESS_KEY
+      B2_S3_SECRET_KEY:
+        from_secret: B2_S3_SECRET_KEY
+      PGPASS:
+        from_secret: PGPASS
+      REPO_RO_TOKEN:
+        from_secret: REPO_RO_TOKEN
+      GITHUB_PAT:
+        from_secret: GITHUB_PAT
+      # normal env vars
+      GIT_USER: pat-s
+      NTFY_SERVER:
+        from_secret: NTFY_SERVER
+      NTFY_TOPIC:
+        from_secret: NTFY_TOPIC
+      NTFY_AUTH: TRUE
+      NTFY_PASSWORD:
+        from_secret: ntfy_token
+      # set the location of the 'pkgcache' cache dir which persists the R package dependencies needed to install the packages themselves
+      R_PKG_CACHE_DIR: /mnt/cache/pkgcache
+      R_LIBS_USER: /mnt/cache/R-pkgs
+      R_VERSION: 4.4.3
+      CCACHE_DIR: /mnt/cache/ccache
+      PLATFORM: redhat-8
+      ARCH: amd64
+      NCPUS: 2
+      STRATEGY: sequential
+      INTERVAL: lubridate::interval(lubridate::today() - 6, lubridate::today() - 3)
+    # volumes:
+    #   - amd64-binaries-r-dep-cache-redhat-8:/mnt/cache
+    commands:
+      - git clone -q https://pat-s:$$REPO_RO_TOKEN@git.devxy.io/devxy/build-cran-binaries.git .
+      - rm -rf /mnt/cache/R-pkgs/00LOCK-r-pkg-binaries /mnt/cache/R-pkgs/00LOCK-bincraft /mnt/cache/R-pkgs/00LOCK-pak /mnt/cache/pkgcache/R/pkgcache /mnt/cache/pkgcache/R/pkgcache /mnt/cache/R-pkgs/pkgcache /mnt/cache/R-pkgs/00LOCK-pak/mnt/cache/R-pkgs/00LOCK-RPostgres /mnt/cache/R-pkgs/bincraft
+      - /opt/R/$R_VERSION/bin/R -q -e 'if (!requireNamespace("bincraft", quietly = TRUE) || packageVersion("bincraft") != "4.1.0") pak::pak("git::https://codefloe.com/rpkgs/bincraft.git@v4.1.0")'
+      - /opt/R/$R_VERSION/bin/R -q -e 'packageVersion("bincraft")'
+      - mkdir -p /mnt/cache/pkgcache /mnt/cache/R-pkgs /mnt/cache/ccache /mnt/cache/packages
+      # options(future.globals.onReference = NULL): for some reason s3fs::file_delete() throws 'Error: Detected a non-exportable reference ('externalptr') in one of the globals ('FUN' of class 'function') used in the future expression' otherwise
+      - xvfb-run /opt/R/$R_VERSION/bin/R -q -e "options(crayon.enabled = TRUE, Ncpus = 4, future.globals.onReference = 'error', repos = structure(c(getOption('repos'),INLA='https://inla.r-inla-download.org/R/stable'))); progressr::handlers('cli'); progressr::handlers(global = TRUE); options(future.globals.onReference = NULL); bincraft::process_cran_updates(interval = $INTERVAL, platform = 'redhat-8', process_updated = TRUE, process_new = TRUE, process_removed = TRUE, s3_endpoint = 'https://s3.eu-central-003.backblazeb2.com', s3_region = 'eu-central-003', s3_bucket = 'devxy-rpkgs-binaries', s3_access_key_id = Sys.getenv('B2_S3_ACCESS_KEY'), s3_secret_access_key = Sys.getenv('B2_S3_SECRET_KEY'), metadata_db_host = 'r-binaries.devxy.io', metadata_db_name = 'build_metadata', metadata_db_table = 'single_builds', metadata_db_user = 'rpkgs', metadata_db_password = Sys.getenv('PGPASS'), metadata_db_sslmode = 'require', metadata_db_port = 15432, archive = TRUE, upload = TRUE, store_build_metadata = TRUE)"
+      - /opt/R/$R_VERSION/bin/R -q -e 'library(bincraft); upload_package_index(codename = "rhel8", s3_endpoint = "https://s3.eu-central-003.backblazeb2.com", s3_region = "eu-central-003", s3_bucket = "devxy-rpkgs-binaries", s3_access_key_id = Sys.getenv("B2_S3_ACCESS_KEY"), s3_secret_access_key = Sys.getenv("B2_S3_SECRET_KEY"))'
+    backend_options:
+      kubernetes:
+        resources:
+          requests:
+            memory: 5Gi
+            cpu: 3000m
+          limits:
+            memory: 18Gi
+            cpu: 3000m
+        nodeSelector:
+          kubernetes.io/arch: amd64
+          node.kubernetes.io/instance-type: AX42
+        tolerations:
+          - key: 'CI'
+            operator: 'Equal'
+            value: 'true'
+            effect: 'NoSchedule'
+
+  - name: Purge CDN cache
+    image: reg.devxy.io/docker.io/library/alpine:3.23
+    environment:
+      BUNNYNET_API_KEY:
+        from_secret: BUNNYNET_API_KEY
+      SUBDOMAIN1: 'cran.devxy.io'
+      SUBDOMAIN2: 'cran.allianceswisspass.devxy.io'
+      SUBDOMAIN3: 'cran.rpkgs.com'
+      OS_ID: rhel8
+      ARCH: amd64
+    commands:
+      - apk add --no-cache -q bash curl
+      - bash scripts/purge_cdn_cache.sh "$BUNNYNET_API_KEY" "$ARCH" "$OS_ID" "$SUBDOMAIN1" "$SUBDOMAIN2" "$SUBDOMAIN3"
--- a/.crow/process-updates-redhat-8-arm64.yaml
+++ b/.crow/process-updates-redhat-8-arm64.yaml
@ -0,0 +1,73 @@
+when:
+  - event: [cron]
+    cron: process-cran-updates-redhat-8-arm64
+  - event: manual
+    evaluate: 'process_cran_updates == "all"'
+  - event: manual
+    evaluate: 'process_cran_updates == "redhat-8-arm64"'
+
+skip_clone: true
+
+labels:
+  agent: gaia
+
+steps:
+  - name: 'Processing Updates'
+    image: reg.devxy.io/rpkgs/build-env-redhat:8
+    pull: true
+    environment:
+      RED_HAT_DEV_PW:
+        from_secret: RED_HAT_DEV_PW
+      B2_S3_ACCESS_KEY:
+        from_secret: B2_S3_ACCESS_KEY
+      B2_S3_SECRET_KEY:
+        from_secret: B2_S3_SECRET_KEY
+      PGPASS:
+        from_secret: PGPASS
+      REPO_RO_TOKEN:
+        from_secret: REPO_RO_TOKEN
+      GITHUB_PAT:
+        from_secret: GITHUB_PAT
+      # normal env vars
+      GIT_USER: pat-s
+      NTFY_SERVER:
+        from_secret: NTFY_SERVER
+      NTFY_TOPIC:
+        from_secret: NTFY_TOPIC
+      NTFY_AUTH: TRUE
+      NTFY_PASSWORD:
+        from_secret: ntfy_token
+      # set the location of the 'pkgcache' cache dir which persists the R package dependencies needed to install the packages themselves
+      R_PKG_CACHE_DIR: /mnt/cache/pkgcache
+      R_LIBS_USER: /mnt/cache/R-pkgs
+      R_VERSION: 4.4.3
+      CCACHE_DIR: /mnt/cache/ccache
+      PLATFORM: redhat-8
+      ARCH: arm64
+      NCPUS: 2
+      INTERVAL: lubridate::interval(lubridate::today() - 6, lubridate::today() - 3)
+    # volumes:
+    #   - arm64-binaries-r-dep-cache-redhat-8:/mnt/cache
+    commands:
+      - git clone -q https://pat-s:$$REPO_RO_TOKEN@git.devxy.io/devxy/build-cran-binaries.git .
+      - rm -rf /mnt/cache/R-pkgs/00LOCK-r-pkg-binaries /mnt/cache/R-pkgs/00LOCK-bincraft /mnt/cache/R-pkgs/00LOCK-pak /mnt/cache/pkgcache/R/pkgcache /mnt/cache/pkgcache/R/pkgcache /mnt/cache/R-pkgs/pkgcache /mnt/cache/R-pkgs/00LOCK-pak/mnt/cache/R-pkgs/00LOCK-RPostgres /mnt/cache/R-pkgs/bincraft
+      - /opt/R/$R_VERSION/bin/R -q -e 'if (!requireNamespace("bincraft", quietly = TRUE) || packageVersion("bincraft") != "4.1.0") pak::pak("git::https://codefloe.com/rpkgs/bincraft.git@v4.1.0")'
+      - /opt/R/$R_VERSION/bin/R -q -e 'packageVersion("bincraft")'
+      - mkdir -p /mnt/cache/pkgcache /mnt/cache/R-pkgs /mnt/cache/ccache /mnt/cache/packages
+      # options(future.globals.onReference = NULL): for some reason s3fs::file_delete() throws 'Error: Detected a non-exportable reference ('externalptr') in one of the globals ('FUN' of class 'function') used in the future expression' otherwise
+      - xvfb-run /opt/R/$R_VERSION/bin/R -q -e "options(crayon.enabled = TRUE, Ncpus = 4, future.globals.onReference = 'error', repos = structure(c(getOption('repos'),INLA='https://inla.r-inla-download.org/R/stable'))); progressr::handlers('cli'); progressr::handlers(global = TRUE); options(future.globals.onReference = NULL); bincraft::process_cran_updates(interval = $INTERVAL, platform = 'redhat-8', process_updated = TRUE, process_new = TRUE, process_removed = TRUE, s3_endpoint = 'https://s3.eu-central-003.backblazeb2.com', s3_region = 'eu-central-003', s3_bucket = 'devxy-rpkgs-binaries', s3_access_key_id = Sys.getenv('B2_S3_ACCESS_KEY'), s3_secret_access_key = Sys.getenv('B2_S3_SECRET_KEY'), metadata_db_host = 'r-binaries.devxy.io', metadata_db_name = 'build_metadata', metadata_db_table = 'single_builds', metadata_db_user = 'rpkgs', metadata_db_password = Sys.getenv('PGPASS'), metadata_db_sslmode = 'require', metadata_db_port = 15432, archive = TRUE, upload = TRUE, store_build_metadata = TRUE)"
+      - /opt/R/$R_VERSION/bin/R -q -e 'library(bincraft); upload_package_index(codename = "rhel8", s3_endpoint = "https://s3.eu-central-003.backblazeb2.com", s3_region = "eu-central-003", s3_bucket = "devxy-rpkgs-binaries", s3_access_key_id = Sys.getenv("B2_S3_ACCESS_KEY"), s3_secret_access_key = Sys.getenv("B2_S3_SECRET_KEY"))'
+
+  - name: Purge CDN cache
+    image: reg.devxy.io/docker.io/library/alpine:3.23
+    environment:
+      BUNNYNET_API_KEY:
+        from_secret: BUNNYNET_API_KEY
+      SUBDOMAIN1: 'cran.devxy.io'
+      SUBDOMAIN2: 'cran.allianceswisspass.devxy.io'
+      SUBDOMAIN3: 'cran.rpkgs.com'
+      OS_ID: rhel8
+      ARCH: arm64
+    commands:
+      - apk add --no-cache -q bash curl
+      - bash scripts/purge_cdn_cache.sh "$BUNNYNET_API_KEY" "$ARCH" "$OS_ID" "$SUBDOMAIN1" "$SUBDOMAIN2" "$SUBDOMAIN3"
--- a/.crow/process-updates-redhat-9-amd64.yaml
+++ b/.crow/process-updates-redhat-9-amd64.yaml
@ -0,0 +1,92 @@
+when:
+  - event: [cron]
+    cron: process-cran-updates-redhat-9-amd64
+  - event: manual
+    evaluate: 'process_cran_updates == "all"'
+  - event: manual
+    evaluate: 'process_cran_updates == "redhat-9-amd64"'
+
+skip_clone: true
+
+labels:
+  agent: artemis
+
+steps:
+  - name: 'Processing Updates'
+    image: reg.devxy.io/rpkgs/build-env-redhat:9
+    pull: true
+    environment:
+      RED_HAT_DEV_PW:
+        from_secret: RED_HAT_DEV_PW
+      B2_S3_ACCESS_KEY:
+        from_secret: B2_S3_ACCESS_KEY
+      B2_S3_SECRET_KEY:
+        from_secret: B2_S3_SECRET_KEY
+      PGPASS:
+        from_secret: PGPASS
+      REPO_RO_TOKEN:
+        from_secret: REPO_RO_TOKEN
+      GITHUB_PAT:
+        from_secret: GITHUB_PAT
+      # normal env vars
+      GIT_USER: pat-s
+      NTFY_SERVER:
+        from_secret: NTFY_SERVER
+      NTFY_TOPIC:
+        from_secret: NTFY_TOPIC
+      NTFY_AUTH: TRUE
+      NTFY_PASSWORD:
+        from_secret: ntfy_token
+      # set the location of the 'pkgcache' cache dir which persists the R package dependencies needed to install the packages themselves
+      R_PKG_CACHE_DIR: /mnt/cache/pkgcache
+      R_LIBS_USER: /mnt/cache/R-pkgs
+      R_VERSION: 4.4.3
+      CCACHE_DIR: /mnt/cache/ccache
+      PLATFORM: redhat-9
+      ARCH: amd64
+      NCPUS: 2
+      MEMORY: 18Gi
+      STRATEGY: sequential
+      INTERVAL: lubridate::interval(lubridate::today() - 6, lubridate::today() - 3)
+    # volumes:
+    #   - amd64-binaries-r-dep-cache-redhat-9:/mnt/cache
+    commands:
+      - git clone -q https://pat-s:$$REPO_RO_TOKEN@git.devxy.io/devxy/build-cran-binaries.git .
+      - rm -rf /mnt/cache/R-pkgs/00LOCK-r-pkg-binaries /mnt/cache/R-pkgs/00LOCK-bincraft /mnt/cache/R-pkgs/00LOCK-pak /mnt/cache/pkgcache/R/pkgcache /mnt/cache/pkgcache/R/pkgcache /mnt/cache/R-pkgs/pkgcache /mnt/cache/R-pkgs/00LOCK-pak/mnt/cache/R-pkgs/00LOCK-RPostgres /mnt/cache/R-pkgs/bincraft
+      - /opt/R/$R_VERSION/bin/R -q -e 'if (!requireNamespace("bincraft", quietly = TRUE) || packageVersion("bincraft") != "4.1.0") pak::pak("git::https://codefloe.com/rpkgs/bincraft.git@v4.1.0")'
+      - /opt/R/$R_VERSION/bin/R -q -e 'packageVersion("bincraft")'
+      - mkdir -p /mnt/cache/pkgcache /mnt/cache/R-pkgs /mnt/cache/ccache /mnt/cache/packages
+      # options(future.globals.onReference = NULL): for some reason s3fs::file_delete() throws 'Error: Detected a non-exportable reference ('externalptr') in one of the globals ('FUN' of class 'function') used in the future expression' otherwise
+      - xvfb-run /opt/R/$R_VERSION/bin/R -q -e "options(crayon.enabled = TRUE, Ncpus = 4, future.globals.onReference = 'error', repos = structure(c(getOption('repos'),INLA='https://inla.r-inla-download.org/R/stable'))); progressr::handlers('cli'); progressr::handlers(global = TRUE); options(future.globals.onReference = NULL); bincraft::process_cran_updates(interval = $INTERVAL, platform = 'redhat-9', process_updated = TRUE, process_new = TRUE, process_removed = TRUE, s3_endpoint = 'https://s3.eu-central-003.backblazeb2.com', s3_region = 'eu-central-003', s3_bucket = 'devxy-rpkgs-binaries', s3_access_key_id = Sys.getenv('B2_S3_ACCESS_KEY'), s3_secret_access_key = Sys.getenv('B2_S3_SECRET_KEY'), metadata_db_host = 'r-binaries.devxy.io', metadata_db_name = 'build_metadata', metadata_db_table = 'single_builds', metadata_db_user = 'rpkgs', metadata_db_password = Sys.getenv('PGPASS'), metadata_db_sslmode = 'require', metadata_db_port = 15432, archive = TRUE, upload = TRUE, store_build_metadata = TRUE)"
+      - /opt/R/$R_VERSION/bin/R -q -e 'library(bincraft); upload_package_index(codename = "rhel9", s3_endpoint = "https://s3.eu-central-003.backblazeb2.com", s3_region = "eu-central-003", s3_bucket = "devxy-rpkgs-binaries", s3_access_key_id = Sys.getenv("B2_S3_ACCESS_KEY"), s3_secret_access_key = Sys.getenv("B2_S3_SECRET_KEY"))'
+    backend_options:
+      kubernetes:
+        resources:
+          requests:
+            memory: 5Gi
+            cpu: 3000m
+          limits:
+            memory: 18Gi
+            cpu: 3000m
+        nodeSelector:
+          kubernetes.io/arch: amd64
+          node.kubernetes.io/instance-type: AX42
+        tolerations:
+          - key: 'CI'
+            operator: 'Equal'
+            value: 'true'
+            effect: 'NoSchedule'
+
+  - name: Purge CDN cache
+    image: reg.devxy.io/docker.io/library/alpine:3.23
+    environment:
+      BUNNYNET_API_KEY:
+        from_secret: BUNNYNET_API_KEY
+      SUBDOMAIN1: 'cran.devxy.io'
+      SUBDOMAIN2: 'cran.allianceswisspass.devxy.io'
+      SUBDOMAIN3: 'cran.rpkgs.com'
+      OS_ID: rhel9
+      ARCH: amd64
+    commands:
+      - apk add --no-cache -q bash curl
+      - bash scripts/purge_cdn_cache.sh "$BUNNYNET_API_KEY" "$ARCH" "$OS_ID" "$SUBDOMAIN1" "$SUBDOMAIN2" "$SUBDOMAIN3"
--- a/Show more
+++ b/Show more