From d582024e1a3fc1586f56273af15643b6126e487e Mon Sep 17 00:00:00 2001 From: pat-s Date: Fri, 4 Sep 2026 19:22:39 +0000 Subject: [PATCH] fix(ci): give the index writers the metadata database password bincraft's index build reads the ABI classifier cache to decide which packages may be carried from the flat slot into a per-minor one. reindex.yaml and weekly-rebuild-reindex.yaml never passed PGPASS, so that query fails: Error: connection to server at "r-binaries.devxy.io" ... fe_sendauth: no password supplied It fails soft by design, so the run still reports success while quietly using an empty cache-derived risky set. That is the exact state the cache was introduced to fix, and it logs one connection error per slot while doing it. build-all-versions.yaml already passes PGPASS, which is why the classification looked correct there and not here. --- .crow/reindex.yaml | 7 +++++++ .crow/weekly-rebuild-reindex.yaml | 7 +++++++ 2 files changed, 14 insertions(+) diff --git a/.crow/reindex.yaml b/.crow/reindex.yaml index b13245a..528def4 100644 --- a/.crow/reindex.yaml +++ b/.crow/reindex.yaml @@ -142,6 +142,13 @@ steps: from_secret: B2_S3_ACCESS_KEY B2_S3_SECRET_KEY: from_secret: B2_S3_SECRET_KEY + # The index build reads the ABI classifier cache to decide which packages + # may be carried from the flat slot into a per-minor one. Without the + # password that query fails, and it fails soft, so the run still succeeds + # while quietly using an empty risky set: exactly the state the cache was + # added to fix. It logs one connection error per slot. + PGPASS: + from_secret: PGPASS REPO_RO_TOKEN: from_secret: REPO_RO_TOKEN GIT_USER: pat-s diff --git a/.crow/weekly-rebuild-reindex.yaml b/.crow/weekly-rebuild-reindex.yaml index c9f9a8a..8de71f7 100644 --- a/.crow/weekly-rebuild-reindex.yaml +++ b/.crow/weekly-rebuild-reindex.yaml @@ -145,6 +145,13 @@ steps: from_secret: B2_S3_ACCESS_KEY B2_S3_SECRET_KEY: from_secret: B2_S3_SECRET_KEY + # The index build reads the ABI classifier cache to decide which packages + # may be carried from the flat slot into a per-minor one. Without the + # password that query fails, and it fails soft, so the run still succeeds + # while quietly using an empty risky set: exactly the state the cache was + # added to fix. It logs one connection error per slot. + PGPASS: + from_secret: PGPASS REPO_RO_TOKEN: from_secret: REPO_RO_TOKEN GIT_USER: pat-s -- 2.54.0