From abe2c5d636f2cfa0f6c458689df6af44aa3ca25d Mon Sep 17 00:00:00 2001
From: Martin Kersner <martin@bisonai.com>
Date: Thu, 2 Jul 2026 15:57:40 +0900
Subject: [PATCH 1/2] ci: add non-blocking live keyed test lane on push to main

Separate workflow (on: push: branches: [main]) so fork/branch pushes
never trigger it and DATAMAXI_API_KEY secret is never exposed to
untrusted refs. Runs full suite (integration+smoke) vs prod;
continue-on-error keeps it non-blocking. Bumps DATAMAXI_TIMEOUT=60 for
slow cold pods. Offline required lane untouched.

Closes #131
---
 .github/workflows/live-tests.yml | 44 ++++++++++++++++++++++++++++++++
 1 file changed, 44 insertions(+)
 create mode 100644 .github/workflows/live-tests.yml

diff --git a/.github/workflows/live-tests.yml b/.github/workflows/live-tests.yml
new file mode 100644
index 0000000..90bac1d
--- /dev/null
+++ b/.github/workflows/live-tests.yml
@@ -0,0 +1,44 @@
+name: Live keyed tests
+
+# Runs the FULL suite (integration + smoke) against prod using the
+# DATAMAXI_API_KEY secret. Gated to push on `main` only: a dedicated
+# `on: push: branches: [main]` guarantees fork/branch pushes never trigger
+# this lane, so the secret is never exposed to untrusted refs.
+on:
+  push:
+    branches: [main]
+    paths-ignore:
+      - '**.md'
+      - 'docs/**'
+      - 'LICENSE'
+      - '.gitignore'
+
+jobs:
+  live:
+    runs-on: ubuntu-latest
+    # Non-blocking: transient prod-data flakiness (cold pods -> 500 "no data
+    # found", empty-page premium ValueError) must not fail a run. PRs never
+    # trigger this lane (main-only), so the required offline build stays the
+    # gating check.
+    continue-on-error: true
+
+    steps:
+    - uses: actions/checkout@v4
+    - name: Set up Python
+      uses: actions/setup-python@v5
+      with:
+        python-version: "3.12"
+    - name: Set up uv
+      uses: astral-sh/setup-uv@v6
+      with:
+        enable-cache: true
+    - name: Install dependencies
+      run: uv pip install --system -r requirements/requirements-test.txt
+    # Full keyed suite: integration + smoke lanes hit prod with the secret key.
+    # DATAMAXI_TIMEOUT bumped past the conftest 30s default to tolerate slow
+    # cold pods.
+    - name: Run live keyed tests
+      env:
+        DATAMAXI_API_KEY: ${{ secrets.DATAMAXI_API_KEY }}
+        DATAMAXI_TIMEOUT: "60"
+      run: python -m pytest tests/ -q

From 9449cf24e911d5ad2c87e81b919c4896c592b05b Mon Sep 17 00:00:00 2001
From: Martin Kersner <martin@bisonai.com>
Date: Thu, 2 Jul 2026 15:58:32 +0900
Subject: [PATCH 2/2] ci: restrict live-tests token to contents:read (least
 privilege)

---
 .github/workflows/live-tests.yml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.github/workflows/live-tests.yml b/.github/workflows/live-tests.yml
index 90bac1d..5ed5787 100644
--- a/.github/workflows/live-tests.yml
+++ b/.github/workflows/live-tests.yml
@@ -13,6 +13,10 @@ on:
       - 'LICENSE'
       - '.gitignore'
 
+# Least-privilege token: the job only checks out code.
+permissions:
+  contents: read
+
 jobs:
   live:
     runs-on: ubuntu-latest