ci(codeql): canonical cron weekly→monthly (cut 3, standards#233 Option B) by hyperpolymath · Pull Request #286 · hyperpolymath/standards

hyperpolymath · 2026-05-30T13:44:13Z

Summary

Single-line cron change in .github/workflows/codeql.yml:

 schedule:
-  - cron: '0 6 * * 1'   # weekly Monday 06:00 UTC
+  - cron: '0 6 1 * *'   # monthly 1st 06:00 UTC

Owner-decision Option B from #233 (selected 2026-05-30).

Scope

Canonical caller template only. The ~206-repo estate sweep is tracked separately; PRs will land staggered to respect GitHub secondary rate-limit.

What changes for callers

Scheduled CodeQL runs go from 52/yr to 12/yr per repo.
PR-trigger runs (push + pull_request) unchanged — every PR still gets CodeQL.
Estate-wide budget impact: ~46k Actions-min/yr saved (~85% of scheduled CodeQL).

Sweep follow-up

A separate tracking issue will list the 206 repos on '0 6 * * 1' for the per-repo conversion sweep.

Refs #233

🤖 Generated with Claude Code

…n B) Owner-decision (2026-05-30) selected Option B from standards#233: move scheduled CodeQL from weekly (Mon 06:00 UTC) to monthly (1st 06:00 UTC). ## Why B (vs A drop-schedule / C allowlist) - ~85% savings (~46k Actions-min/yr) without an estate-wide stratification exercise (avoids C's per-repo decision cost and A's worst-case CVE-lag). - Bounded 30-day CVE-detection floor for every repo, regardless of activity. - Monthly cadence aligns with the CVE→CodeQL-query propagation cycle, so practical detection delta vs weekly is small. - Single mechanical fan-out — same shape as cuts 1+2 (#230, #231). ## Scope This PR changes ONLY the canonical caller template here. The estate-wide sweep (~206 repos on the weekly cadence) is tracked separately; per-repo PRs will land staggered to respect GitHub secondary rate-limit. PR-trigger runs (push + pull_request) are kept regardless of this cut. The schedule-block change is orthogonal to per-PR coverage. Refs #233 Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

github-actions · 2026-05-30T13:45:31Z

🔍 Hypatia Security Scan

Findings: 183 issues detected

Severity	Count
🔴 Critical	65
🟠 High	30
🟡 Medium	88

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Action perpolymath/standards/.github/workflows/governance-reusable.yml@main\n needs attention",
    "type": "unpinned_action",
    "file": "governance.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in affinescript-verify.yml",
    "type": "unknown",
    "file": "affinescript-verify.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in boj-build.yml",
    "type": "unknown",
    "file": "boj-build.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in casket-pages.yml",
    "type": "unknown",
    "file": "casket-pages.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in casket-pages.yml",
    "type": "unknown",
    "file": "casket-pages.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in changelog-reusable.yml",
    "type": "unknown",
    "file": "changelog-reusable.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in codeql-reusable.yml",
    "type": "unknown",
    "file": "codeql-reusable.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in codeql.yml",
    "type": "unknown",
    "file": "codeql.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in deno-ci-reusable.yml",
    "type": "unknown",
    "file": "deno-ci-reusable.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in doc-format.yml",
    "type": "unknown",
    "file": "doc-format.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence

## Summary Single-line cron change in `.github/workflows/codeql.yml` (and any vendored subpath copies in this repo): ```diff schedule: - - cron: '0 6 * * 1' # weekly Monday 06:00 UTC + - cron: '0 6 1 * *' # monthly 1st 06:00 UTC ``` Mirrors `hyperpolymath/standards#286` (canonical caller template). ## Scope Owner-decision Option B from `standards#233` selected 2026-05-30. PR-trigger runs (`push` + `pull_request`) unchanged — every PR still gets CodeQL coverage. ## Sweep Estate-wide tracker: `hyperpolymath/standards#288`. Refs hyperpolymath/standards#233 #288 #286 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Per owner-decision Option B on hyperpolymath/standards#233 (2026-05-30): move scheduled CodeQL from weekly (`'0 6 * * 1'`) to monthly (`'0 6 1 * *'`). Same shape as canonical caller-template change in hyperpolymath/standards#286. ## Why - ~85% Actions-minute savings on scheduled CodeQL (12 runs/yr vs 52). - Bounded 30-day CVE-detection floor. - PR-trigger runs (push + pull_request) unchanged — every PR still gets CodeQL coverage. ## Sweep Part of estate-wide sweep tracked at hyperpolymath/standards#288. Refs hyperpolymath/standards#233 Refs hyperpolymath/standards#288 Refs hyperpolymath/standards#286 Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>