Pass the canary's paid secrets only on a weekly run; the daily run stays free

.github/workflows/canary.yml

@@ -36,6 +36,10 @@ name: canary
 on:
   schedule:
     - cron: "23 6 * * *"
+    # Mondays: the same jobs, WITH the paid secrets (proxy, Scraping Browser,
+    # captcha key). On the daily run above those secrets read as empty, so
+    # it takes the free no-secret route and bills nothing.
+    - cron: "23 6 * * 1"
   workflow_dispatch:
 
 jobs:
@@ -74,8 +78,8 @@ jobs:
         # the step from failing the job; it does not touch the shell's errexit.
         continue-on-error: true
         env:
-          SPINNY_CDP_ENDPOINT: ${{ secrets.SPINNY_CDP_ENDPOINT }}
-          TWOCAPTCHA_KEY: ${{ secrets.TWOCAPTCHA_KEY }}
+          SPINNY_CDP_ENDPOINT: ${{ (github.event_name != 'schedule' || github.event.schedule == '23 6 * * 1') && secrets.SPINNY_CDP_ENDPOINT || '' }}
+          TWOCAPTCHA_KEY: ${{ (github.event_name != 'schedule' || github.event.schedule == '23 6 * * 1') && secrets.TWOCAPTCHA_KEY || '' }}
         run: |
           set +e
           python3 playwright_scraper.py \

CHANGELOG.md

@@ -13,6 +13,12 @@ with it, so nobody discovers it from a bill or from a diff.
 
 ## [Unreleased]
 
+### Changed
+
+- CI only: the canary's optional paid secrets `SPINNY_CDP_ENDPOINT`, `TWOCAPTCHA_KEY` now reach it only on a new weekly
+  run (Mondays 06:23 UTC) and on a manual dispatch. The daily run keeps its
+  schedule and takes the free route without them, so it bills nothing.
+
 ## [0.2.0] — 2026-10-15
 
 > **Behaviour change:** `--retries 0` is now a usage error (exit 2). It used

CONTRIBUTING.md

@@ -107,7 +107,8 @@ Then the rest of the presentation, in the order that matters:
    hand before the badge is trusted. Unlike its siblings this canary needs
    **no credential** — the site serves a bare GitHub runner, measured — so it
    is scheduled daily as well. The optional `SPINNY_CDP_ENDPOINT` secret,
-   when set, routes the same run through the Scraping Browser API; no step is
+   when set, routes the weekly (Monday) run and a manual dispatch through the
+   Scraping Browser API (the daily run never uses it, so it bills nothing); no step is
    gated on it, so the canary keeps working the day it expires.
 2. The repo description, homepage and topics set: a description naming what the site
    publishes and the 2Captcha Scraping Browser API, the 2captcha.com

smoke_test.py

@@ -1738,9 +1738,13 @@ def test_canary_separates_access_from_defect():
     # on it, or the canary quietly stops running the day it expires.
     ok &= check("no step is gated on the optional secret",
                 "HAVE_CDP" not in wf)
+    # It is a paid route, so it reaches the run on the weekly (Monday)
+    # schedule and on a manual dispatch only; the daily run reads it empty.
     ok &= check("...and the secret still reaches the run through the "
                 "environment, never argv",
-                "SPINNY_CDP_ENDPOINT: ${{ secrets.SPINNY_CDP_ENDPOINT }}" in wf
+                "SPINNY_CDP_ENDPOINT: ${{ (github.event_name != 'schedule' || "
+                "github.event.schedule == '23 6 * * 1') && "
+                "secrets.SPINNY_CDP_ENDPOINT || '' }}" in wf
                 and "--cdp-endpoint" not in wf.split("run:")[-3])
     return ok