fix(ci): give the index writers the metadata database password #201

Merged

pat-s merged 1 commit from fix/pgpass-for-index-writers into main

2026-09-04 19:26:55 +00:00

pat-s commented

2026-09-04 19:22:42 +00:00

Owner

Why

Pipeline 12207 logs one of these per slot:

Error: connection to server at "r-binaries.devxy.io" (116.203.165.191), port 15432 failed:
  fe_sendauth: no password supplied

bincraft's index build calls abi_cache_risky_packages() to decide which packages may be carried from the flat slot into a per-minor index. reindex.yaml and weekly-rebuild-reindex.yaml never passed PGPASS, so the query cannot connect.

It fails soft by design, which is what makes this worth fixing rather than tolerating: the run still reports success while using an empty cache-derived risky set. The index is then written as though no package were known risky from the classifier, which is the exact state the cache was added to fix.

build-all-versions.yaml already passes PGPASS, which is why classification behaved correctly there and silently degraded here.

What changed

Adds the PGPASS secret to both index-writing workflows, with a comment explaining why its absence is invisible rather than loud.

crow lint passes on both files.

Note

The tarball-derived half of the risky set still worked, so indexes written without this are not wrong so much as incomplete: they miss packages that are known risky from classification but have no per-minor tarball yet. A re-index after this merges applies the full set.

## Why Pipeline 12207 logs one of these per slot: ``` Error: connection to server at "r-binaries.devxy.io" (116.203.165.191), port 15432 failed: fe_sendauth: no password supplied ``` bincraft's index build calls `abi_cache_risky_packages()` to decide which packages may be carried from the flat slot into a per-minor index. `reindex.yaml` and `weekly-rebuild-reindex.yaml` never passed `PGPASS`, so the query cannot connect. It fails soft by design, which is what makes this worth fixing rather than tolerating: the run still reports **success** while using an empty cache-derived risky set. The index is then written as though no package were known risky from the classifier, which is the exact state the cache was added to fix. `build-all-versions.yaml` already passes `PGPASS`, which is why classification behaved correctly there and silently degraded here. ## What changed Adds the `PGPASS` secret to both index-writing workflows, with a comment explaining why its absence is invisible rather than loud. `crow lint` passes on both files. ## Note The tarball-derived half of the risky set still worked, so indexes written without this are not wrong so much as incomplete: they miss packages that are known risky from classification but have no per-minor tarball yet. A re-index after this merges applies the full set.

pat-s added 1 commit

2026-09-04 19:22:42 +00:00

fix(ci): give the index writers the metadata database password d582024e1a

bincraft's index build reads the ABI classifier cache to decide which packages
may be carried from the flat slot into a per-minor one. reindex.yaml and
weekly-rebuild-reindex.yaml never passed PGPASS, so that query fails:

  Error: connection to server at "r-binaries.devxy.io" ...
  fe_sendauth: no password supplied

It fails soft by design, so the run still reports success while quietly using an
empty cache-derived risky set. That is the exact state the cache was introduced
to fix, and it logs one connection error per slot while doing it.

build-all-versions.yaml already passes PGPASS, which is why the classification
looked correct there and not here.

pat-s merged commit e1114bc145 into main

2026-09-04 19:26:55 +00:00

pat-s deleted branch fix/pgpass-for-index-writers

2026-09-04 19:26:56 +00:00

pat-s referenced this pull request from a commit

2026-09-04 19:26:56 +00:00

fix(ci): give the index writers the metadata database password (#201)