feat(rules): extend WF024 chapel + add cron-drift + inherited-debt detectors (auto-fix wiring)

[hyperpolymath]

Continues today's hardening from hypatia#414. Three patterns we hit manually that should be auto-handled next time: Chapel 5 sharp edges, CodeQL cron drift, inherited main-branch debt. License category remains auto_fixable:false per #415.

Commits

• 99b7970 WF024 chapel auto-fix wiring + 4 sub-pattern recipes

  • Primary WF024 finding now sets auto_fixable: true + recipe_id: chapel-runs-on-pin-22-04
  • New check_chapel_sharp_edges/1 emits 4 recipes: chapel-manpath-guard, chapel-chpl-llvm-export, chapel-replace-chpl-about-with-version, chapel-find-comm-gasnet (panic-attack#99)

• 2285685 WF025 CodeQL cron-drift detector

  • Canonical 0 6 1 * * per standards#286
  • Sub-categories route to standards#288 (weekly→monthly) vs standards#324 (non-canonical→canonical)
  • Shared recipe codeql-cron-monthly

• df4f545 BH008 inherited-main-branch-debt detector

  • Threshold ≥3 open PRs sharing same failing check → flag (:warn, auto_fixable: false)
  • Recommends file_root_fix_pr_on_main instead of N retries

Test plan

• Each rule has ExUnit coverage under test/rules/
• Chapel detector test covers all 5 recipe_ids + maximal-bad-workflow case
• Cron-drift classifier covers canonical / weekly / non-canonical-monthly / malformed
• Inherited-debt fires at 3 PRs, NOT at 2; honors custom threshold; per-PR-unique failures suppressed
• CI to verify mix test (local mix env was Elixir 1.14 — couldn't fetch deps); individual files compile clean via elixirc

🤖 Generated with Claude Code

[github-actions]

🔍 Hypatia Security Scan

Findings: 146 issues detected

Severity	Count
🔴 Critical	0
🟠 High	0
🟡 Medium	146

View findings

[
  {
    "reason": "Action urin 21 JRE\n        uses: actions/setup-java@be666c2fcd27 needs attention",
    "type": "unpinned_action",
    "file": "verify-proofs.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in ci.yml",
    "type": "missing_timeout_minutes",
    "file": "ci.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in ci.yml",
    "type": "missing_timeout_minutes",
    "file": "ci.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in ci.yml",
    "type": "missing_timeout_minutes",
    "file": "ci.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in ci.yml",
    "type": "missing_timeout_minutes",
    "file": "ci.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in ci.yml",
    "type": "missing_timeout_minutes",
    "file": "ci.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in ci.yml",
    "type": "missing_timeout_minutes",
    "file": "ci.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in ci.yml",
    "type": "missing_timeout_minutes",
    "file": "ci.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in ci.yml",
    "type": "missing_timeout_minutes",
    "file": "ci.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in clusterfuzzlite.yml",
    "type": "missing_timeout_minutes",
    "file": "clusterfuzzlite.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence