fix(ci): run MinIO writer canary on protected main pushes

.github/workflows/hosted-kache-canary.yml

@@ -1,14 +1,18 @@
 name: Hosted Kache canary
 
 on:
+  push:
+    branches: [main]
+    paths:
+      - ".github/workflows/hosted-kache-canary.yml"
+      - "ci/kache-hosted-canary/**"
+      - "docs/workflow-catalog.md"
   pull_request:
     paths:
       - ".github/workflows/hosted-kache-canary.yml"
       - "ci/kache-hosted-canary/**"
       - "docs/workflow-catalog.md"
   workflow_dispatch:
-  schedule:
-    - cron: "17 9 * * 0"
 
 concurrency:
   group: hosted-kache-canary-${{ github.ref }}
@@ -26,7 +30,7 @@ env:
 jobs:
   pr-build:
     name: Build canary without shared credentials
-    if: github.event_name == 'pull_request'
+    if: github.event_name != 'push'
     runs-on: ubuntu-24.04
     timeout-minutes: 15
     steps:
@@ -45,7 +49,8 @@ jobs:
       - name: Compile the canary
         run: cargo build --release --locked --manifest-path "$CANARY_MANIFEST"
   seed:
-    if: github.event_name != 'pull_request' && github.ref == 'refs/heads/main'
+    # Kache 0.28.1 permits writers only on protected branch push events.
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main' && github.ref_protected
     name: Seed hosted remote
     runs-on: ubuntu-24.04
     timeout-minutes: 15
@@ -88,7 +93,8 @@ jobs:
             >> "$GITHUB_STEP_SUMMARY"
 
   verify:
-    if: github.event_name != 'pull_request' && github.ref == 'refs/heads/main'
+    # Kache 0.28.1 permits writers only on protected branch push events.
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main' && github.ref_protected
     name: Verify fresh hosted remote reuse
     needs: [seed]
     runs-on: ubuntu-24.04

docs/workflow-catalog.md

@@ -102,7 +102,9 @@ Internal workflows:
 - `manage-release.yml` owns this repository's Release Please event;
 - `publish-ci-images.yml` publishes images only from a GitHub release;
 - `hosted-kache-canary.yml` seeds MinIO on one hosted runner and requires
-  remote cache reuse on a second fresh runner.
+  remote cache reuse on a second fresh runner after a protected main push.
+  Kache 0.28.1 treats manual and scheduled GitHub runs as read-only; manual
+  dispatch therefore checks compilation without shared credentials.
 
 ## Profiles
 

tests/test_validate.py

@@ -179,10 +179,13 @@ def test_canary_keeps_shared_credentials_off_pull_requests(self) -> None:
         )
         for job_name in ("seed", "verify"):
             job = workflow["jobs"][job_name]
-            self.assertIn("github.event_name != 'pull_request'", job["if"])
+            self.assertIn("github.event_name == 'push'", job["if"])
+            self.assertIn("github.ref_protected", job["if"])
             self.assertIn("github.ref == 'refs/heads/main'", job["if"])
             cache = next(step for step in job["steps"] if "kache-action@" in step.get("uses", ""))
             self.assertEqual(cache["with"]["s3-prefix"], "${{ env.CANARY_CACHE_PREFIX }}")
+        self.assertEqual(workflow["on"]["push"]["branches"], ["main"])
+        self.assertNotIn("schedule", workflow["on"])
         self.assertIn("github.run_id", workflow["env"]["CANARY_CACHE_PREFIX"])
         self.assertIn("kache-0.28.1", workflow["env"]["CANARY_CACHE_PREFIX"])
         self.assertNotIn("secrets.", str(workflow["jobs"]["pr-build"]))