From 11c819148ddc45ba9531faad49da3a69f396c717 Mon Sep 17 00:00:00 2001
From: jehrr <79864894+jehrr@users.noreply.github.com>
Date: Fri, 16 Oct 2026 11:36:02 +0000
Subject: [PATCH] Pass the canary's paid secrets only on a weekly run; the
 daily run stays free

Paid canary paths (proxy, Scraping Browser, captcha) run weekly on Mondays;
free paths keep their daily schedule. A manual dispatch runs everything.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CKsd7q25N19WzUZjrAdzx8
---
 .github/workflows/canary.yml | 6 +++++-
 CHANGELOG.md                 | 6 ++++++
 smoke_test.py                | 8 ++++++--
 3 files changed, 17 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/canary.yml b/.github/workflows/canary.yml
index 74101e5..97931f7 100644
--- a/.github/workflows/canary.yml
+++ b/.github/workflows/canary.yml
@@ -33,6 +33,10 @@ name: canary
 on:
   schedule:
     - cron: "17 19 * * *"       # 05:17 Australian eastern time, off-peak
+    # Mondays: the same jobs, WITH the paid secrets (proxy, Scraping Browser,
+    # captcha key). On the daily run above those secrets read as empty, so
+    # it takes the free no-secret route and bills nothing.
+    - cron: "17 19 * * 1"
   workflow_dispatch:
 
 permissions:
@@ -68,7 +72,7 @@ jobs:
       - name: Run the canary
         id: run
         env:
-          WOOLWORTHS_PROXY: ${{ secrets.WOOLWORTHS_PROXY }}
+          WOOLWORTHS_PROXY: ${{ (github.event_name != 'schedule' || github.event.schedule == '17 19 * * 1') && secrets.WOOLWORTHS_PROXY || '' }}
         run: |
           # set +e: GitHub runs `run:` under `bash -e`, so a non-zero exit
           # would abort the step BEFORE the exit code could be captured, and
diff --git a/CHANGELOG.md b/CHANGELOG.md
index b1d5819..37ae6d8 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -11,6 +11,12 @@ rather than leaving anyone to discover it from their own output.
 
 ## [Unreleased]
 
+### Changed
+
+- CI only: the canary's optional paid secret `WOOLWORTHS_PROXY` now reaches it only on a new weekly
+  run (Mondays 19:17 UTC) and on a manual dispatch. The daily run keeps its
+  schedule and takes the free route without them, so it bills nothing.
+
 ## [0.5.1] — 2026-10-16
 
 > **Behaviour change.** `--allow-empty` now writes an empty file only for a
diff --git a/smoke_test.py b/smoke_test.py
index 4166431..01ffb05 100644
--- a/smoke_test.py
+++ b/smoke_test.py
@@ -1551,8 +1551,12 @@ def test_the_canary_is_not_gated_on_a_credential():
     for step in ("Run the canary", "Assert what the run actually produced"):
         assert f"name: {step}" in wf, f"the canary lost its {step!r} step"
     # A proxy secret, where one IS set, must still reach the run — and still
-    # through the environment rather than a command line.
-    assert "WOOLWORTHS_PROXY: ${{ secrets.WOOLWORTHS_PROXY }}" in wf, (
+    # through the environment rather than a command line. It is a paid route,
+    # so it reaches the run on the weekly (Monday) schedule and on a manual
+    # dispatch only; the daily run reads it empty and runs without it.
+    assert ("WOOLWORTHS_PROXY: ${{ (github.event_name != 'schedule' || "
+            "github.event.schedule == '17 19 * * 1') && "
+            "secrets.WOOLWORTHS_PROXY || '' }}") in wf, (
         "a proxy secret would no longer be used even if set")
     assert "--proxy " not in wf, "a credential must not reach a command line"