From eb7731d62c8311804249ad134a9003b57c852e83 Mon Sep 17 00:00:00 2001 From: jehrr <79864894+jehrr@users.noreply.github.com> Date: Fri, 16 Oct 2026 11:35:53 +0000 Subject: [PATCH] Pass the canary's paid secrets only on a weekly run; the daily run stays free Paid canary paths (proxy, Scraping Browser, captcha) run weekly on Mondays; free paths keep their daily schedule. A manual dispatch runs everything. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01CKsd7q25N19WzUZjrAdzx8 --- .github/workflows/canary.yml | 8 ++++++-- CHANGELOG.md | 6 ++++++ CONTRIBUTING.md | 3 ++- smoke_test.py | 6 +++++- 4 files changed, 19 insertions(+), 4 deletions(-) diff --git a/.github/workflows/canary.yml b/.github/workflows/canary.yml index 0a23136..33767f4 100644 --- a/.github/workflows/canary.yml +++ b/.github/workflows/canary.yml @@ -36,6 +36,10 @@ name: canary on: schedule: - cron: "23 6 * * *" + # Mondays: the same jobs, WITH the paid secrets (proxy, Scraping Browser, + # captcha key). On the daily run above those secrets read as empty, so + # it takes the free no-secret route and bills nothing. + - cron: "23 6 * * 1" workflow_dispatch: jobs: @@ -74,8 +78,8 @@ jobs: # the step from failing the job; it does not touch the shell's errexit. continue-on-error: true env: - SPINNY_CDP_ENDPOINT: ${{ secrets.SPINNY_CDP_ENDPOINT }} - TWOCAPTCHA_KEY: ${{ secrets.TWOCAPTCHA_KEY }} + SPINNY_CDP_ENDPOINT: ${{ (github.event_name != 'schedule' || github.event.schedule == '23 6 * * 1') && secrets.SPINNY_CDP_ENDPOINT || '' }} + TWOCAPTCHA_KEY: ${{ (github.event_name != 'schedule' || github.event.schedule == '23 6 * * 1') && secrets.TWOCAPTCHA_KEY || '' }} run: | set +e python3 playwright_scraper.py \ diff --git a/CHANGELOG.md b/CHANGELOG.md index 41d0996..8713961 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -13,6 +13,12 @@ with it, so nobody discovers it from a bill or from a diff. ## [Unreleased] +### Changed + +- CI only: the canary's optional paid secrets `SPINNY_CDP_ENDPOINT`, `TWOCAPTCHA_KEY` now reach it only on a new weekly + run (Mondays 06:23 UTC) and on a manual dispatch. The daily run keeps its + schedule and takes the free route without them, so it bills nothing. + ## [0.2.0] — 2026-10-15 > **Behaviour change:** `--retries 0` is now a usage error (exit 2). It used diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 515da3b..023796f 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -107,7 +107,8 @@ Then the rest of the presentation, in the order that matters: hand before the badge is trusted. Unlike its siblings this canary needs **no credential** — the site serves a bare GitHub runner, measured — so it is scheduled daily as well. The optional `SPINNY_CDP_ENDPOINT` secret, - when set, routes the same run through the Scraping Browser API; no step is + when set, routes the weekly (Monday) run and a manual dispatch through the + Scraping Browser API (the daily run never uses it, so it bills nothing); no step is gated on it, so the canary keeps working the day it expires. 2. The repo description, homepage and topics set: a description naming what the site publishes and the 2Captcha Scraping Browser API, the 2captcha.com diff --git a/smoke_test.py b/smoke_test.py index 00a703b..810d383 100644 --- a/smoke_test.py +++ b/smoke_test.py @@ -1738,9 +1738,13 @@ def test_canary_separates_access_from_defect(): # on it, or the canary quietly stops running the day it expires. ok &= check("no step is gated on the optional secret", "HAVE_CDP" not in wf) + # It is a paid route, so it reaches the run on the weekly (Monday) + # schedule and on a manual dispatch only; the daily run reads it empty. ok &= check("...and the secret still reaches the run through the " "environment, never argv", - "SPINNY_CDP_ENDPOINT: ${{ secrets.SPINNY_CDP_ENDPOINT }}" in wf + "SPINNY_CDP_ENDPOINT: ${{ (github.event_name != 'schedule' || " + "github.event.schedule == '23 6 * * 1') && " + "secrets.SPINNY_CDP_ENDPOINT || '' }}" in wf and "--cdp-endpoint" not in wf.split("run:")[-3]) return ok