Release v0.7.0

[mrustl]

wasserportal 0.7.0 2026-06-18

This release extends the ThingsBoard integration shipped in 0.6.0 so it also
works against self-hosted ThingsBoard instances and can push the entire
Wasserportal groundwater archive, not just the five-station demo.

Self-hosted ThingsBoard authentication

• New tb_login() plus username/password (JWT) authentication across all
  ThingsBoard tenant-API helpers (tb_setup_devices(), tb_get_device_id(),
  tb_list_device_telemetry_keys(), tb_delete_device_telemetry()).
  Self-hosted Community Edition has no account-level API keys (a ThingsBoard
  Cloud convenience), so it is reached via POST /api/auth/login → a
  short-lived JWT sent as X-Authorization: Bearer <token>. Set TB_USERNAME
  • TB_PASSWORD (these win over TB_API_KEY when both are present); the
    Cloud API-key path keeps working unchanged. The thingsboard-push.yaml
    workflow reads the two new credentials from the matching repository secrets.
• tb_login() retries on {408, 429, 500, 502, 503, 504} with up to 4 tries,
  so tb_setup_devices() survives a cold-start 5xx from a self-hosted
  ThingsBoard sitting behind nginx / a load balancer.
• tb_auth_header() warns when only one of TB_USERNAME / TB_PASSWORD
  is set and a leftover TB_API_KEY silently falls back to the Cloud path,
  so the common "one secret missing" misconfiguration is called out instead
  of failing obscurely downstream.
• Non-2xx responses surface a server response-body excerpt (≤ ~800 chars) in
  R errors and retry messages. Stock ThingsBoard does not echo credentials,
  but operators whose reverse proxy echoes request fields should mask secrets
  in their CI logs.

Push every station, not just the demo five

• TB_MAX_DEVICES=0 lifts the 5-device demo cap and pushes every selected
  station -- now wired into the workflow as a repository secret and a
  workflow_dispatch input.
• TB_STATION_SCOPE chooses which groundwater stations the auto-pick
  considers: both (default -- level and quality, the proven demo set),
  any (level or quality), gwl / gwq (has that series, possibly both)
  or gwl-only / gwq-only (has only that series). TB_TELEMETRY_TYPES
  still decides which series get pushed per station.
• Station scoring counts distinct quality parameters once via split() +
  vapply() (returning a plain named integer vector), so scoring the full
  several-hundred-station pool stays fast; the selection diagnostic now labels
  the strict intersect row clearly against the relaxed per-series counts.
• The push script now validates its numeric TB_* variables up front
  (TB_MAX_DEVICES, TB_HISTORY_DAYS, TB_CHUNK_SIZE, TB_THROTTLE_SECONDS,
  TB_MAX_ACTIVE) and aborts with a clear message on a non-numeric value,
  instead of letting an NA crash mid-push after every device attribute set
  was already uploaded. The message flags the usual cause -- .Renviron does
  not support inline # comments.

For a full self-hosted push set TB_PLAN=ce, TB_MAX_DEVICES=0 and
TB_STATION_SCOPE=any. Mind the volume -- several hundred devices over the
full archive is millions of data points; start with a bounded
TB_HISTORY_DAYS to validate the run.

Documentation & packaging

• Update the Kompetenzzentrum Wasser Berlin (KWB) author logo on the pkgdown
  site to the new brand asset.
• The package now requires R ≥ 4.1.0 (Depends), reflecting the native
  |> pipe used in the ThingsBoard code; the unused LazyData field was
  removed.

This change is 

[mrustl]

@claude bitte am ende noch NEWS.md updaten

[claude]

Claude finished @mrustl's task in 1m 51s —— View job

---

Done

• Read current NEWS.md to understand existing style
• Check recent commits on dev for changes not yet reflected in NEWS
• Update NEWS.md with the new entries
• Commit and push to dev (25bfd9d)

Added two bullets to the 0.7.0 section of NEWS.md covering the PR-review follow-ups already landed on dev:

• tb_auth_header() now warns when only one of TB_USERNAME / TB_PASSWORD is set and a leftover TB_API_KEY silently picks the API-key path (commit bd4640a).
• The station-selection diagnostic in inst/scripts/push_to_thingsboard.R renames the strict-intersect row to in both master files AND has both series so the asymmetry against the per-series union rows is visible (commit 27a1a66).

The earlier 0.7.0 bullets (JWT auth, configurable station scope, KWB logo refresh) are untouched. The pending review threads about tapply() → vapply(split(...)) and tb_login() retry widening are tracked in their own Claude jobs; once those land you may want a follow-up NEWS bullet for them too.
· Branch dev

[mrustl]

@claude check if .Rd files are up to date and update NEWS.md

[claude]

Claude finished @mrustl's task in 4m 4s —— View job

---

Done

• Checked .Rd files — all up to date

  • 9 exported tb_* helpers + inspect_gh_pages_zips each have a matching man/*.Rd; the 4 internal helpers (tb_default_host, tb_auth_header, tb_get_or_create_device, tb_get_device_access_token) are correctly @noRd / @keywords internal
  • NAMESPACE exports line up with all @export tags in R/
  • man/tb_login.Rd reflects the latest roxygen from c37d70f (retry-widening details + Credentials in error output section)
  • No R/ changes since the last man/*.Rd regeneration — no drift

• Updated NEWS.md with two follow-up bullets for changes that landed on dev after the prior NEWS update — committed and pushed as d19f6b5:

  • Refreshed the station-scope bullet: via tapply() → via split() + vapply() (returns a plain named integer vector, matches the idiom in R/get_stations.R / R/inspect_gh_pages_zips.R) — covers commit d96f576
  • Added a new bullet for tb_login() retry-widening: predicate now {408, 429, 500, 502, 503, 504}, max_tries = 4, matching tb_push_station_telemetry(), plus the documented trade-off that tb_error_body() excerpts surface in R errors / req_retry() stderr — covers commit c37d70f

The earlier 0.7.0 bullets (JWT auth, configurable station scope, KWB logo, partial-JWT warning, intersect-row label) are untouched.
· Branch dev

[mrustl]

@claude use Opus 4.8 as new default

[claude]

Claude finished @mrustl's task in 55s —— View job

---

Tasks

• Locate where the Claude model default is set
• Identify required change (claude-opus-4-7 → claude-opus-4-8)
• Apply edits in .github/workflows/*.yaml — blocked by permissions

Where the default lives

The default model is pinned in two workflow files:

• .github/workflows/claude.yaml:38 — claude_args: '--model claude-opus-4-7'
• .github/workflows/claude-code-review.yaml:40 — claude_args: '--model claude-opus-4-7 --allowed-tools "..."'

Both need claude-opus-4-7 → claude-opus-4-8.

Why I can't push this myself

I'm unable to modify files under .github/workflows/ — the GitHub App that runs me does not have the workflows permission, so any push that touches a workflow file is rejected by the API. You can find more context in the FAQ.

Patch to apply locally

--- a/.github/workflows/claude.yaml
+++ b/.github/workflows/claude.yaml
@@ -35,4 +35,4 @@ jobs:
         uses: anthropics/claude-code-action@v1
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
-          claude_args: '--model claude-opus-4-7'
+          claude_args: '--model claude-opus-4-8'

--- a/.github/workflows/claude-code-review.yaml
+++ b/.github/workflows/claude-code-review.yaml
@@ -37,4 +37,4 @@ jobs:
             - Test coverage
             - Documentation (roxygen2) completeness
             - Consistency with the existing codebase
-          claude_args: '--model claude-opus-4-7 --allowed-tools "mcp__github_inline_comment__create_inline_comment,Bash(gh issue view:*),Bash(gh search:*),Bash(gh issue list:*),Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*),Bash(gh pr list:*)"'
+          claude_args: '--model claude-opus-4-8 --allowed-tools "mcp__github_inline_comment__create_inline_comment,Bash(gh issue view:*),Bash(gh search:*),Bash(gh issue list:*),Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*),Bash(gh pr list:*)"'

One-liner to apply both edits:

sed -i 's/claude-opus-4-7/claude-opus-4-8/g' \
  .github/workflows/claude.yaml \
  .github/workflows/claude-code-review.yaml

Once you commit and push that (or merge a small PR with just these two changes), every subsequent @claude invocation on this repo will run on Opus 4.8.
· Branch dev