Repository navigation
Pass the canary's paid secrets only on a weekly run; the daily run stays free - #13
Merged
Merged
Conversation
…ays free Paid canary paths (proxy, Scraping Browser, captcha) run weekly on Mondays; free paths keep their daily schedule. A manual dispatch runs everything. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CKsd7q25N19WzUZjrAdzx8
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem: the canary runs daily and its job(s) (
live-run) work from a bare runner with no secret, but each passes the optional paid secret(s)SPINNY_CDP_ENDPOINT,TWOCAPTCHA_KEYinto the run when set. With a secret configured, every daily run would bill proxy traffic or a Scraping Browser session.Change: a second schedule,
23 6(Mondays, at the daily run's hour and minute), is added, and each of those secrets is now mapped as${{ (github.event_name != 'schedule' || github.event.schedule == '23 6') && secrets.X || '' }}(and the presence flags likewise). On the daily run the secrets read as empty, so the job takes its free no-secret route exactly as it does today without them; on the Monday run and on any manual dispatch they reach the run as before. No job is skipped and no job is made weekly, because the jobs themselves are free paths. No secret named here is currently set in this repository, so today's daily runs are unchanged. CONTRIBUTING now says the secret is used on the Monday run only.smoke_test.pypinned the old mapping stringSPINNY_CDP_ENDPOINT: ${{ secrets.SPINNY_CDP_ENDPOINT }}("the secret still reaches the run"); it now pins the gated mapping. Control: restoring main's canary.yml turns that check red; with this change the suite is green in a core-only venv.Not changed: what each canary job runs and asserts, its thresholds, and its behaviour when a secret is missing (a paid job without its secret still fails with an
::error::naming it, now on its weekly run).workflow_dispatchstill runs every job.Evidence: the edited workflow parses as YAML and its
on.schedule/ jobif:values were printed from the parsed file (listed above). The offline suite runs in this PR'stestsworkflow on the head commit. No paid call was made to check this change.🤖 Generated with Claude Code
https://claude.ai/code/session_01CKsd7q25N19WzUZjrAdzx8