build-cran-binaries/justfile

# Local helpers for build-cran-binaries.
#
# `rebuild` (re)builds specific versions of a single package on a given OS/arch
# by dispatching to a remote buildx builder (the build runs there, not locally).
# Sensitivity is auto-detected: risky packages land in the per-minor slot
# (contrib/<x.y>/), everything else in the generic slot; the touched index is
# refreshed so the result is immediately servable.
#
# Prerequisites:
#   - buildx builders named `artemis` (amd64) and `gaia` (arm64), created with the
#     docker-container driver (runs BuildKit on the remote host's docker daemon over
#     SSH). The default `remote` driver does NOT work with an ssh:// docker host.
#     Pass --config docker/buildkitd.toml so BuildKit's GC keeps a usable cache
#     (the default caps the cache-mount tier at 512 MB, forcing re-downloads).
#       docker buildx create --name artemis --driver docker-container --config docker/buildkitd.toml ssh://<user@host-amd64>
#       docker buildx create --name gaia    --driver docker-container --config docker/buildkitd.toml ssh://<user@host-arm64>
#   - exported secrets: B2_S3_ACCESS_KEY, B2_S3_SECRET_KEY, PGPASS (GITHUB_PAT optional)
#
# Overridable (env or `just VAR=… rebuild …`):
#   R_VERSION (default 4.5.3) — selects the R minor → the per-minor slot
#   AMD64_BUILDER / ARM64_BUILDER — buildx builder names
#
# Examples:
#   just rebuild alpine 3.23 amd64 rlang 1.1.4 1.1.3
#   just rebuild redhat 10 arm64 data.table 1.15.4
#   R_VERSION=4.4.3 just rebuild ubuntu noble amd64 Rcpp 1.0.12

r_version := env_var_or_default("R_VERSION", "4.5.3")
amd64_builder := env_var_or_default("AMD64_BUILDER", "artemis")
arm64_builder := env_var_or_default("ARM64_BUILDER", "gaia")

# (re)build PACKAGE at one or more VERSIONS on OS/TAG/ARCH via a remote builder
rebuild os tag arch package *versions:
    #!/usr/bin/env bash
    set -euo pipefail
    if [ -z "{{ versions }}" ]; then
      echo "error: provide at least one version, e.g. just rebuild alpine 3.23 amd64 rlang 1.1.4" >&2
      exit 1
    fi
    case "{{ arch }}" in
      amd64) builder="{{ amd64_builder }}" ;;
      arm64) builder="{{ arm64_builder }}" ;;
      *) echo "error: arch must be 'amd64' or 'arm64'" >&2; exit 1 ;;
    esac
    # Accept TF_VAR_-prefixed names (direnv) or plain names.
    export B2_S3_ACCESS_KEY="${B2_S3_ACCESS_KEY:-${TF_VAR_B2_S3_ACCESS_KEY:-}}"
    export B2_S3_SECRET_KEY="${B2_S3_SECRET_KEY:-${TF_VAR_B2_S3_SECRET_KEY:-}}"
    : "${B2_S3_ACCESS_KEY:?set B2_S3_ACCESS_KEY or TF_VAR_B2_S3_ACCESS_KEY}"
    : "${B2_S3_SECRET_KEY:?set B2_S3_SECRET_KEY or TF_VAR_B2_S3_SECRET_KEY}"
    : "${PGPASS:?set PGPASS}"
    secret_args=(
      --secret id=b2_access,env=B2_S3_ACCESS_KEY
      --secret id=b2_secret,env=B2_S3_SECRET_KEY
      --secret id=pgpass,env=PGPASS
    )
    # GITHUB_PAT is optional (raises the GitHub API rate limit); pass only if set.
    if [ -n "${GITHUB_PAT:-}" ]; then
      secret_args+=(--secret id=github_pat,env=GITHUB_PAT)
    fi
    echo "Dispatching build of {{ package }} ({{ versions }}) on {{ os }}:{{ tag }}/{{ arch }} (R {{ r_version }}) to builder '$builder'"
    docker buildx build \
      --builder "$builder" \
      --platform "linux/{{ arch }}" \
      --no-cache \
      --progress=plain \
      --output type=cacheonly \
      "${secret_args[@]}" \
      --build-arg OS="{{ os }}" \
      --build-arg OS_VERSION="{{ tag }}" \
      --build-arg R_VERSION="{{ r_version }}" \
      --build-arg PACKAGE="{{ package }}" \
      --build-arg VERSIONS="{{ versions }}" \
      --build-arg CACHEBUST="$(date +%s)" \
      -f docker/build-one.Dockerfile \
      local

# run the edge middleware routing matrix (uses a local deno, else the deno image)
edge-test:
    #!/usr/bin/env bash
    set -euo pipefail
    if command -v deno >/dev/null 2>&1; then
      deno test -A edge/rpkgs-router.test.ts
    else
      docker run --rm \
        -v "$PWD:/w" -w /w \
        -v deno-cache:/deno-dir \
        denoland/deno:latest \
        deno test -A edge/rpkgs-router.test.ts
    fi

# fail if any pipeline still targets a slot the edge does not route
check-slots:
    Rscript local/check-slots.R

# strip a retired slot from .crow/*.yaml (dry run; pass --apply to write)
retire-slot codename *flags:
    Rscript local/retire-slot.R {{ codename }} --config-only {{ flags }}