How to handle bioconductor packages

[jeroen]

Where to source from

Currently, BioConductor packages are treated the same as CRAN packages: r-universe automatically indexes and tracks all packages that have a GitHub/GitLab URL in their package description. We track about 1000 bioc packages (of 2140) this way, which seems to be the subset of actively maintained projects: https://bioconductor.r-universe.dev/ui#builds

BioConductor also has an official git server, where releases are based off: https://git.bioconductor.org. @hpages mentions it may be safer to track from there, because the GitHub sources are sometimes out of date, and many bioc packages are not on GitHub. However the bioconductor git server does not provide us any information on the package authors, contributors, organisation, development activity, bug tracker, and so on. It's mostly just a distribution mirror.

Also if we would track all bioc packages from git.bioconductor.org, and the package authors also sign up their packages for r-universe via GitHub, we get duplicates in the system, where both the bioconductor and GitHub package are indexed as separate packages.

It's also not clear to me where the development happens for the remaining packages that are not on GitHub. Many don't have any issue tracker, and only dummy commits by a bot to bump the version. I'm not sure if these projects are actively maintained at all, but maybe I am missing something. So to summarize:

Tracking packages from GitHub (current solution):

• Rich metadata about development activity, open issues, organization, etc.
• Moslty actively maintained projects (not just bot/dummy commits)
• We can just use the same build system as CRAN and other R packages
• Con: some GitHub sources are out of date because authors push to bioc but not Github (why??)

Tracking from git.bioconductor.org:

• We can index all bioc packages, even the ones that are unmaintained or not developed on GitHub
• Con: duplicates on r-universe when authors also sign up their package
• Con: no metadata.

Which branch to track

An additional problem is which branches we should track. Most CRAN (and other) R packages are developed such that the master branch will at least work on the current r-release and stable dependencies from cran/bioc.

However BioConductor has a more orchestrated development model, where the master version of each package is only assumed to work on the development version of bioconductor. To make things worse, development version of bioconductor uses the version of R that will be stable 6 months later, so during part of the year this is r-devel and the other part it is r-release. This logic is very difficult to support in a generic build system. In general CI on r-devel is a pain because there are no CRAN/RSPM binaries.

So it seems the only robust solution is to track the release branches for each package, though this will not reveal current development activity that happens on the master branch.