Run every canary job weekly on Mondays

.github/workflows/canary.yml

@@ -1,9 +1,9 @@
 name: canary
 
-# One real run a day against woolworths.com.au, and the only workflow in this
+# One real run a week (Mondays) against woolworths.com.au, and the only workflow in this
 # repo that touches the site. Everything else is offline (see tests.yml).
 #
-# THIS CANARY RUNS LIVE, EVERY DAY, WITH NO CREDENTIAL — on purpose.
+# THIS CANARY RUNS LIVE, EVERY MONDAY, WITH NO CREDENTIAL — on purpose.
 #
 # It used to skip unless a `WOOLWORTHS_PROXY` secret was set, on the reasoning
 # that "Akamai refuses this site to a datacentre address, and a GitHub runner
@@ -20,9 +20,9 @@ name: canary
 #
 # A canary that CAN pass without a credential must never
 # be gated on one. The README's central promise is that this site needs no
-# key, no proxy and no account, and an ungated daily run is that sentence
-# under test every morning. If Woolworths starts refusing runners, this goes
-# red the next day and the promise is retested without anyone remembering to.
+# key, no proxy and no account, and an ungated weekly run is that sentence
+# under test every Monday. If Woolworths starts refusing runners, this goes
+# red on the next weekly run and the promise is retested without anyone remembering to.
 #
 # A `WOOLWORTHS_PROXY` secret is still USED if one is set — it goes through
 # the ENVIRONMENT rather than a `--proxy` line, because `env_config.py`
@@ -32,11 +32,7 @@ name: canary
 
 on:
   schedule:
-    - cron: "17 19 * * *"       # 05:17 Australian eastern time, off-peak
-    # Mondays: the same jobs, WITH the paid secrets (proxy, Scraping Browser,
-    # captcha key). On the daily run above those secrets read as empty, so
-    # it takes the free no-secret route and bills nothing.
-    - cron: "17 19 * * 1"
+    - cron: "17 19 * * 1"       # Mondays 19:17 UTC (Tuesday 05:17 Australian eastern standard time), off-peak
   workflow_dispatch:
 
 permissions:
@@ -72,7 +68,7 @@ jobs:
       - name: Run the canary
         id: run
         env:
-          WOOLWORTHS_PROXY: ${{ (github.event_name != 'schedule' || github.event.schedule == '17 19 * * 1') && secrets.WOOLWORTHS_PROXY || '' }}
+          WOOLWORTHS_PROXY: ${{ secrets.WOOLWORTHS_PROXY }}
         run: |
           # set +e: GitHub runs `run:` under `bash -e`, so a non-zero exit
           # would abort the step BEFORE the exit code could be captured, and

CHANGELOG.md

@@ -13,9 +13,7 @@ rather than leaving anyone to discover it from their own output.
 
 ### Changed
 
-- CI only: the canary's optional paid secret `WOOLWORTHS_PROXY` now reaches it only on a new weekly
-  run (Mondays 19:17 UTC) and on a manual dispatch. The daily run keeps its
-  schedule and takes the free route without them, so it bills nothing.
+- CI only: the canary now runs weekly (Mondays 19:17 UTC) and on a manual dispatch, with its optional secret `WOOLWORTHS_PROXY` passed on every run; the daily schedule is removed.
 
 ## [0.5.1] — 2026-10-16
 

README.md

@@ -61,7 +61,7 @@ addresses have now been measured being served headful — a German VPS on
 2026-09-16 and a GitHub-hosted runner in Azure `westus3` on 2026-10-08, the
 latter returning 109 rows with `status: complete` and no credential of any
 kind. So "Akamai refuses datacentres" is NOT what this site does; it refuses
-headless clients, and the daily canary runs ungated from a runner to keep
+headless clients, and the weekly (Monday) canary runs ungated from a runner to keep
 that claim under test.
 
 If your address is refused anyway: `--proxy`, `--proxy-file`, or

smoke_test.py

@@ -1551,12 +1551,8 @@ def test_the_canary_is_not_gated_on_a_credential():
     for step in ("Run the canary", "Assert what the run actually produced"):
         assert f"name: {step}" in wf, f"the canary lost its {step!r} step"
     # A proxy secret, where one IS set, must still reach the run — and still
-    # through the environment rather than a command line. It is a paid route,
-    # so it reaches the run on the weekly (Monday) schedule and on a manual
-    # dispatch only; the daily run reads it empty and runs without it.
-    assert ("WOOLWORTHS_PROXY: ${{ (github.event_name != 'schedule' || "
-            "github.event.schedule == '17 19 * * 1') && "
-            "secrets.WOOLWORTHS_PROXY || '' }}") in wf, (
+    # through the environment rather than a command line.
+    assert "WOOLWORTHS_PROXY: ${{ secrets.WOOLWORTHS_PROXY }}" in wf, (
         "a proxy secret would no longer be used even if set")
     assert "--proxy " not in wf, "a credential must not reach a command line"