From f774a121c42e272279618169ff49302885d91b0f Mon Sep 17 00:00:00 2001 From: jehrr <79864894+jehrr@users.noreply.github.com> Date: Fri, 16 Oct 2026 11:56:56 +0000 Subject: [PATCH] Run every canary job weekly on Mondays The canary now has a single Monday cron. The daily cron is removed, and so is the gating that held the paid job or secret back to the Monday run: a scheduled run and a manual dispatch now run every job the same way, with each secret mapped plainly. A job that needs a secret still fails, naming it, when the secret is missing. Wording that said the canary (or its free half) runs daily now says weekly (Mondays). Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01CKsd7q25N19WzUZjrAdzx8 --- .github/workflows/canary.yml | 18 +++++++----------- CHANGELOG.md | 4 +--- README.md | 2 +- smoke_test.py | 8 ++------ 4 files changed, 11 insertions(+), 21 deletions(-) diff --git a/.github/workflows/canary.yml b/.github/workflows/canary.yml index 97931f7..dc16d2e 100644 --- a/.github/workflows/canary.yml +++ b/.github/workflows/canary.yml @@ -1,9 +1,9 @@ name: canary -# One real run a day against woolworths.com.au, and the only workflow in this +# One real run a week (Mondays) against woolworths.com.au, and the only workflow in this # repo that touches the site. Everything else is offline (see tests.yml). # -# THIS CANARY RUNS LIVE, EVERY DAY, WITH NO CREDENTIAL — on purpose. +# THIS CANARY RUNS LIVE, EVERY MONDAY, WITH NO CREDENTIAL — on purpose. # # It used to skip unless a `WOOLWORTHS_PROXY` secret was set, on the reasoning # that "Akamai refuses this site to a datacentre address, and a GitHub runner @@ -20,9 +20,9 @@ name: canary # # A canary that CAN pass without a credential must never # be gated on one. The README's central promise is that this site needs no -# key, no proxy and no account, and an ungated daily run is that sentence -# under test every morning. If Woolworths starts refusing runners, this goes -# red the next day and the promise is retested without anyone remembering to. +# key, no proxy and no account, and an ungated weekly run is that sentence +# under test every Monday. If Woolworths starts refusing runners, this goes +# red on the next weekly run and the promise is retested without anyone remembering to. # # A `WOOLWORTHS_PROXY` secret is still USED if one is set — it goes through # the ENVIRONMENT rather than a `--proxy` line, because `env_config.py` @@ -32,11 +32,7 @@ name: canary on: schedule: - - cron: "17 19 * * *" # 05:17 Australian eastern time, off-peak - # Mondays: the same jobs, WITH the paid secrets (proxy, Scraping Browser, - # captcha key). On the daily run above those secrets read as empty, so - # it takes the free no-secret route and bills nothing. - - cron: "17 19 * * 1" + - cron: "17 19 * * 1" # Mondays 19:17 UTC (Tuesday 05:17 Australian eastern standard time), off-peak workflow_dispatch: permissions: @@ -72,7 +68,7 @@ jobs: - name: Run the canary id: run env: - WOOLWORTHS_PROXY: ${{ (github.event_name != 'schedule' || github.event.schedule == '17 19 * * 1') && secrets.WOOLWORTHS_PROXY || '' }} + WOOLWORTHS_PROXY: ${{ secrets.WOOLWORTHS_PROXY }} run: | # set +e: GitHub runs `run:` under `bash -e`, so a non-zero exit # would abort the step BEFORE the exit code could be captured, and diff --git a/CHANGELOG.md b/CHANGELOG.md index 37ae6d8..c30a052 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -13,9 +13,7 @@ rather than leaving anyone to discover it from their own output. ### Changed -- CI only: the canary's optional paid secret `WOOLWORTHS_PROXY` now reaches it only on a new weekly - run (Mondays 19:17 UTC) and on a manual dispatch. The daily run keeps its - schedule and takes the free route without them, so it bills nothing. +- CI only: the canary now runs weekly (Mondays 19:17 UTC) and on a manual dispatch, with its optional secret `WOOLWORTHS_PROXY` passed on every run; the daily schedule is removed. ## [0.5.1] — 2026-10-16 diff --git a/README.md b/README.md index 3a1f618..8963c99 100644 --- a/README.md +++ b/README.md @@ -61,7 +61,7 @@ addresses have now been measured being served headful — a German VPS on 2026-09-16 and a GitHub-hosted runner in Azure `westus3` on 2026-10-08, the latter returning 109 rows with `status: complete` and no credential of any kind. So "Akamai refuses datacentres" is NOT what this site does; it refuses -headless clients, and the daily canary runs ungated from a runner to keep +headless clients, and the weekly (Monday) canary runs ungated from a runner to keep that claim under test. If your address is refused anyway: `--proxy`, `--proxy-file`, or diff --git a/smoke_test.py b/smoke_test.py index 01ffb05..4166431 100644 --- a/smoke_test.py +++ b/smoke_test.py @@ -1551,12 +1551,8 @@ def test_the_canary_is_not_gated_on_a_credential(): for step in ("Run the canary", "Assert what the run actually produced"): assert f"name: {step}" in wf, f"the canary lost its {step!r} step" # A proxy secret, where one IS set, must still reach the run — and still - # through the environment rather than a command line. It is a paid route, - # so it reaches the run on the weekly (Monday) schedule and on a manual - # dispatch only; the daily run reads it empty and runs without it. - assert ("WOOLWORTHS_PROXY: ${{ (github.event_name != 'schedule' || " - "github.event.schedule == '17 19 * * 1') && " - "secrets.WOOLWORTHS_PROXY || '' }}") in wf, ( + # through the environment rather than a command line. + assert "WOOLWORTHS_PROXY: ${{ secrets.WOOLWORTHS_PROXY }}" in wf, ( "a proxy secret would no longer be used even if set") assert "--proxy " not in wf, "a credential must not reach a command line"