Dropped the IPS_TO_SKIP secret in favor of the excluded_ips.txt file on the host

.github/workflows/name-run+extraction_archive-ember_runner-typhon_trigger-cron+dispatch_freq-daily.yml

@@ -11,20 +11,13 @@ concurrency:
 
 env:
   S3_LOG_BASE_PATH: "/mnt/s3-logs/ember-s3-logs"
-  IPS_TO_SKIP: ${{ secrets.IPS_TO_SKIP }}
 
 jobs:
   CheckTyphon:
     name: Pre-run Check
     runs-on: ubuntu-latest
     if: github.event_name == 'workflow_dispatch' || github.event_name == 'schedule'
     steps:
-      # The extractor reads this as a regex of requester IPs to drop, and an empty regex matches every IP,
-      # so a run without it would silently extract nothing.
-      - name: Validate required secrets
-        run: |
-          [ -n "$IPS_TO_SKIP" ] || { echo "Repository secret IPS_TO_SKIP must be set: a regex of requester IPs to drop, or ^$ to drop none."; exit 1; }
-
       - name: Cancel if offline
         uses: CodyCBakerPhD/check-runner-action@v1
         with:

README.md

@@ -36,14 +36,24 @@ Repository secrets:
 
 - `S3_LOG_EXTRACTION_PASSWORD`
 - `MAXMIND_ACCOUNT_ID` / `MAXMIND_LICENSE_KEY`
-- `IPS_TO_SKIP` (required by the extraction): a regex of requester IPs to leave out. The extractor treats an empty value
-  as matching every IP and would record nothing, so with none to leave out, set it to `^$`.
 - `SUMMARIES_REPOSITORY_TOKEN` (required by the summaries upload): a fine-grained token with the resource owner
   `aplbrain`, access to only `aplbrain/ember-dandi-access-summaries`, and the permission `Contents: Read and write`.
   Fine-grained tokens expire, and an expired one fails the upload, so renew it and update the secret.
 - `_GITHUB_API_KEY` (token able to list this repository's runners, for the pre-run check)
 - `MAIL_USERNAME` / `MAIL_PASSWORD` (failure notifications)
 
+Requester IPs to leave out are listed on the runner's host in the runner user's
+`~/.s3-log-extraction/excluded_ips.txt`, one address per line, with `#` comments. This file is the only list of
+excluded addresses. The extraction drops their requests and every summaries workflow leaves them out, so no repository
+secret is needed. If the DANDI runner runs as the same user on the host, the two runners share this one file.
+
+Only exact addresses are accepted. Networks in CIDR notation and patterns are refused with an error. An absent or
+empty file leaves no one out.
+
+Exclusion only works in one direction over time. Adding an address drops its requests from future extraction.
+Removing an address from the file does not bring its requests back, since they were never extracted. To include an
+address again, the extraction has to be rerun from scratch (`reset extraction`, then a full `extract`).
+
 The summaries map EMBER content IDs to Dandisets through
 [ember-cache/content-id-to-usage-dandiset-path](https://github.com/ember-cache/content-id-to-usage-dandiset-path)
 (its `dist` branch), named in the summaries workflows. The plugin's default is DANDI's cache, which holds no EMBER content.