Build on debian:trixie with R 4.5 / BioC 3.22

[ESCRI11]

Companion to bigomics/omicsplayground#1843. Both must land together — see "The two pins" below.

What this is

Rebuilds the playbase base image on debian:trixie instead of ubuntu:24.04. This is where the trixie migration actually lives; the omicsplayground side just points at the result.

The distro swap forces an R and Bioconductor upgrade: trixie ships R 4.5.0, and BiocManager hard-refuses BioC 3.18 on R 4.5 (requires R version 4.3; use version = '3.22'). No R 4.3 exists for trixie. So R 4.3→4.5 and BioC 3.18→3.22 come along whether we like it or not — that jump, not the FROM line, is the real project risk.

Status

Built from scratch and verified: Debian 13 · R 4.5.0 · BioC 3.22, squashed to one layer. Downstream, the full Omics Playground image built on top of it serves HTTP 200, loads a real dataset (18 samples, 7118 features, 5 contrasts), renders base/ggplot/embedding plots, and exports PDFs through both the typst and LaTeX report engines.

What changed

• dev/Dockerfile.os, dev/Dockerfile.rbase, dev/install_ubuntu.sh — trixie base and its fallout. trixie has gcc-14 (noble had gcc-13), so the hardcoded /usr/include/c++/13/ msa hack breaks; apt-key is gone so the Chrome install needs signed-by=; software-properties-common does not exist in trixie
• dev/functions.R, dev/install_playbase.R — BioC 3.22. The version was pinned in three places; fixing only the Dockerfile leaves the other two to re-pin 3.18 at runtime
• +libmagick++-dev, which was cascading into GSVA/plaid failures
• dev/rspm.R — trixie PPM URL, plus HTTPUserAgent. Fixing the URL alone changes nothing: without the User-Agent, R sends libcurl/x.y.z and PPM answers with source packages, so these builds had never actually used binaries
• dev/PINS.md — documents the pinning rules

The two pins

dev/rspm.R here and dev/Rprofile in omicsplayground must carry the same snapshot date.

PPM's latest served lattice 0.23-1, which dropped the parallel export that methylumi 2.56.0 still imports. Cascade: methylumi → lumi → wateRmelon, and wateRmelon is a playbase Import, so install_playbase.R fails outright — playbase gets removed and scan_description() then dies reading the DESCRIPTION of the package that was just deleted.

The two failure modes look nothing alike, which is what makes this nasty:

• here it is loud — packages fail to build, playbase refuses to install, build stops
• in the opg stages it is silent — the packages are already installed from this base, requirements.R merely upgrades lattice over them, nothing errors, and they become unloadable while the build exits 0

PPM's source index advertised 0.22-9 while the binary channel shipped 0.23-1, so checking src/contrib/PACKAGES does not reveal this. PPM later withdrew 0.23-1, meaning latest also flip-flops — a dated snapshot is the only stable choice for a migration we are trying to validate.

Gotchas found while building this

• make docker always fails. Its final docker.squash target guards on [ -z `command -v pipx &> /dev/null` ], which captures no output and is therefore always true, so it prints ERROR and exits 1 every time. Not fixed here.
• make docker.pkg returns 0 on failure. The recipe ends in | tee and make's recipe shell has no pipefail, so a failed docker build reports success. This masked a real failure for an entire build cycle. Call docker build directly when failures need to surface.
• The squash matters for more than size (it is in fact larger): the temporary GITHUB_PAT is baked into an intermediate layer of playbase-pkg, and squashing plus docker rmi playbase-pkg is what removes it.

Not done

• This image is not on Docker Hub. It exists only on the build host, so CI cannot do a full trixie build until someone publishes a trixie bigomics/playbase tag.
• This branch is ~20 commits behind main and will want a rebase before merge.
• Dockerfile.update on the opg side still has 9 unauthenticated install_github steps, costing ~17 calls of the 60/hr per-IP budget. They normally pass but fail on a shared office IP.

🤖 Generated with Claude Code