From 5def3d8ff89b5d14f51ce7f93542fc9c2fc81ee6 Mon Sep 17 00:00:00 2001
From: Jacob Magar <jmagar@gmail.com>
Date: Thu, 1 Oct 2026 02:18:12 -0400
Subject: [PATCH] fix(ci): seed Kache canary only on protected main pushes

---
 .github/workflows/hosted-kache-canary.yml | 16 +++++++++++-----
 docs/workflow-catalog.md                  |  4 +++-
 tests/test_validate.py                    |  5 ++++-
 3 files changed, 18 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/hosted-kache-canary.yml b/.github/workflows/hosted-kache-canary.yml
index bcb2f72..a6ce8ea 100644
--- a/.github/workflows/hosted-kache-canary.yml
+++ b/.github/workflows/hosted-kache-canary.yml
@@ -1,14 +1,18 @@
 name: Hosted Kache canary
 
 on:
+  push:
+    branches: [main]
+    paths:
+      - ".github/workflows/hosted-kache-canary.yml"
+      - "ci/kache-hosted-canary/**"
+      - "docs/workflow-catalog.md"
   pull_request:
     paths:
       - ".github/workflows/hosted-kache-canary.yml"
       - "ci/kache-hosted-canary/**"
       - "docs/workflow-catalog.md"
   workflow_dispatch:
-  schedule:
-    - cron: "17 9 * * 0"
 
 concurrency:
   group: hosted-kache-canary-${{ github.ref }}
@@ -26,7 +30,7 @@ env:
 jobs:
   pr-build:
     name: Build canary without shared credentials
-    if: github.event_name == 'pull_request'
+    if: github.event_name != 'push'
     runs-on: ubuntu-24.04
     timeout-minutes: 15
     steps:
@@ -45,7 +49,8 @@ jobs:
       - name: Compile the canary
         run: cargo build --release --locked --manifest-path "$CANARY_MANIFEST"
   seed:
-    if: github.event_name != 'pull_request' && github.ref == 'refs/heads/main'
+    # Kache 0.28.1 permits writers only on protected branch push events.
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main' && github.ref_protected
     name: Seed hosted remote
     runs-on: ubuntu-24.04
     timeout-minutes: 15
@@ -88,7 +93,8 @@ jobs:
             >> "$GITHUB_STEP_SUMMARY"
 
   verify:
-    if: github.event_name != 'pull_request' && github.ref == 'refs/heads/main'
+    # Kache 0.28.1 permits writers only on protected branch push events.
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main' && github.ref_protected
     name: Verify fresh hosted remote reuse
     needs: [seed]
     runs-on: ubuntu-24.04
diff --git a/docs/workflow-catalog.md b/docs/workflow-catalog.md
index dfa9a2f..b385ed0 100644
--- a/docs/workflow-catalog.md
+++ b/docs/workflow-catalog.md
@@ -102,7 +102,9 @@ Internal workflows:
 - `manage-release.yml` owns this repository's Release Please event;
 - `publish-ci-images.yml` publishes images only from a GitHub release;
 - `hosted-kache-canary.yml` seeds MinIO on one hosted runner and requires
-  remote cache reuse on a second fresh runner.
+  remote cache reuse on a second fresh runner after a protected main push.
+  Kache 0.28.1 treats manual and scheduled GitHub runs as read-only; manual
+  dispatch therefore checks compilation without shared credentials.
 
 ## Profiles
 
diff --git a/tests/test_validate.py b/tests/test_validate.py
index 33ce50c..bdae272 100644
--- a/tests/test_validate.py
+++ b/tests/test_validate.py
@@ -179,10 +179,13 @@ def test_canary_keeps_shared_credentials_off_pull_requests(self) -> None:
         )
         for job_name in ("seed", "verify"):
             job = workflow["jobs"][job_name]
-            self.assertIn("github.event_name != 'pull_request'", job["if"])
+            self.assertIn("github.event_name == 'push'", job["if"])
+            self.assertIn("github.ref_protected", job["if"])
             self.assertIn("github.ref == 'refs/heads/main'", job["if"])
             cache = next(step for step in job["steps"] if "kache-action@" in step.get("uses", ""))
             self.assertEqual(cache["with"]["s3-prefix"], "${{ env.CANARY_CACHE_PREFIX }}")
+        self.assertEqual(workflow["on"]["push"]["branches"], ["main"])
+        self.assertNotIn("schedule", workflow["on"])
         self.assertIn("github.run_id", workflow["env"]["CANARY_CACHE_PREFIX"])
         self.assertIn("kache-0.28.1", workflow["env"]["CANARY_CACHE_PREFIX"])
         self.assertNotIn("secrets.", str(workflow["jobs"]["pr-build"]))