Pass the canary's paid secrets only on a weekly run; the daily run stays free

.github/workflows/canary.yml

@@ -27,6 +27,10 @@ on:
   schedule:
     # 05:40 UTC. Not on the hour: every scheduled workflow fires at :00.
     - cron: "40 5 * * *"
+    # Mondays: the same jobs, WITH the paid secrets (proxy, Scraping Browser,
+    # captcha key). On the daily run above those secrets read as empty, so
+    # it takes the free no-secret route and bills nothing.
+    - cron: "40 5 * * 1"
   workflow_dispatch:
 
 permissions:
@@ -69,7 +73,7 @@ jobs:
             pages: 1
             floor: 1
     env:
-      HACKERNEWS_PROXY: ${{ secrets.HACKERNEWS_PROXY }}
+      HACKERNEWS_PROXY: ${{ (github.event_name != 'schedule' || github.event.schedule == '40 5 * * 1') && secrets.HACKERNEWS_PROXY || '' }}
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-python@v5

CHANGELOG.md

@@ -9,6 +9,12 @@ said so at the top of its release notes.
 
 ## [Unreleased]
 
+### Changed
+
+- CI only: the canary's optional paid secret `HACKERNEWS_PROXY` now reaches it only on a new weekly
+  run (Mondays 05:40 UTC) and on a manual dispatch. The daily run keeps its
+  schedule and takes the free route without them, so it bills nothing.
+
 ## [0.1.0] — 2026-10-15
 
 > **A page that says it has rows and parses to none now exits 5 (or 6), not