From c9cee9accc171a94028d5d9c56c8b698db1907aa Mon Sep 17 00:00:00 2001
From: jehrr <79864894+jehrr@users.noreply.github.com>
Date: Fri, 16 Oct 2026 11:35:38 +0000
Subject: [PATCH] Pass the canary's paid secrets only on a weekly run; the
 daily run stays free

Paid canary paths (proxy, Scraping Browser, captcha) run weekly on Mondays;
free paths keep their daily schedule. A manual dispatch runs everything.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CKsd7q25N19WzUZjrAdzx8
---
 .github/workflows/canary.yml | 10 +++++++---
 CHANGELOG.md                 |  6 ++++++
 2 files changed, 13 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/canary.yml b/.github/workflows/canary.yml
index 20f1f32..366e073 100644
--- a/.github/workflows/canary.yml
+++ b/.github/workflows/canary.yml
@@ -49,6 +49,10 @@ on:
     # 06:20 UTC. Off the hour, because everything else in the world runs on
     # it and a queued runner adds nothing but latency.
     - cron: "20 6 * * *"
+    # Mondays: the same jobs, WITH the paid secrets (proxy, Scraping Browser,
+    # captcha key). On the daily run above those secrets read as empty, so
+    # it takes the free no-secret route and bills nothing.
+    - cron: "20 6 * * 1"
   workflow_dispatch:
 
 permissions:
@@ -78,7 +82,7 @@ jobs:
       - name: Walk a collection's items
         id: items
         env:
-          OPENSEA_PROXY: ${{ secrets.OPENSEA_PROXY }}
+          OPENSEA_PROXY: ${{ (github.event_name != 'schedule' || github.event.schedule == '20 6 * * 1') && secrets.OPENSEA_PROXY || '' }}
         # `set +e`: GitHub runs `run:` steps under `bash -e`, so a non-zero
         # command aborts the step BEFORE the following echo, and
         # continue-on-error does not change that — it stops the step failing
@@ -244,7 +248,7 @@ jobs:
       - name: Scrape OpenSea's own ranking
         id: ranking
         env:
-          OPENSEA_PROXY: ${{ secrets.OPENSEA_PROXY }}
+          OPENSEA_PROXY: ${{ (github.event_name != 'schedule' || github.event.schedule == '20 6 * * 1') && secrets.OPENSEA_PROXY || '' }}
         run: |
           set +e
           python3 playwright_scraper.py \
@@ -324,7 +328,7 @@ jobs:
       - name: Scrape a collection's sales feed
         id: activity
         env:
-          OPENSEA_PROXY: ${{ secrets.OPENSEA_PROXY }}
+          OPENSEA_PROXY: ${{ (github.event_name != 'schedule' || github.event.schedule == '20 6 * * 1') && secrets.OPENSEA_PROXY || '' }}
         run: |
           set +e
           python3 playwright_scraper.py \
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 17e1961..4d64e78 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -14,6 +14,12 @@ was written, because anyone can read it with `git show v0.1.0:CHANGELOG.md`.
 
 ## [Unreleased]
 
+### Changed
+
+- CI only: the canary's optional paid secret `OPENSEA_PROXY` now reaches it only on a new weekly
+  run (Mondays 06:20 UTC) and on a manual dispatch. The daily run keeps its
+  schedule and takes the free route without them, so it bills nothing.
+
 ## [0.2.0] - 2026-10-16
 
 > **Behaviour changes in this batch, read before upgrading a script:**