[campaign] Estate CodeQL weekly→monthly sweep (cut 3, standards#233 Option B — ~206 repos)

[hyperpolymath]

Campaign overview

Per-repo fan-out of the canonical CodeQL cron change shipped in standards#286 (cut 3, owner-decision Option B 2026-05-30): convert ~206 repos from weekly ('0 6 * * 1') to monthly ('0 6 1 * *') CodeQL scheduled runs.

Why

• 85% savings (~46k Actions-min/yr) without estate-wide stratification.
• Bounded 30-day CVE-detection floor for every repo.
• Single mechanical fan-out — same shape as cuts 1+2 (chore(scorecard-reusable): align example with canonical weekly schedule + document drift #230, GH Actions budget: convert 180 estate repos from daily to weekly scorecard schedule (cut 2 fan-out) #231).

Scope (audit 2026-05-28 + 2026-05-30)

Schedule	Count	Action
Weekly Monday 06:00 UTC ('0 6 * * 1')	~206	Convert to monthly via this sweep
Other weekly cadences	~15	Lower-priority follow-up
Already inline / non-reusable	varies	Out of scope for this sweep

Mechanical change per repo

 schedule:
-  - cron: '0 6 * * 1'   # weekly Monday 06:00 UTC
+  - cron: '0 6 1 * *'   # monthly 1st 06:00 UTC

PR-trigger runs (push + pull_request) unchanged — every PR still gets CodeQL.

Constraints

• GitHub PR-create secondary rate-limit: ~5 PRs / 30min (operator memory).
• Estimated total: 206 PRs × 6min stagger = ~21 hours of background sweep time.
• Multi-session execution; resume by re-auditing repos still on '0 6 * * 1'.
• Skip echo-types/ (owner hands-off).
• Per-PR ownership gate: each repo must satisfy owner=hyperpolymath, isFork=false, parent=null.

Sequencing

• ✅ Canonical change: standards#286 (OPEN, auto-merge armed 2026-05-30)
• ⏳ Sweep execution: gated on canonical merging + the scorecard sweep standards#282 completing (to avoid rate-limit collision)
• ⏳ Long-tail (~15 repos on non-canonical weekly cadences): follow-up after main sweep

Acceptance

• 206 PRs land (or skipped where no-op)
• Estate-wide CodeQL audit shows monthly cron everywhere or documented exception
• 6-week budget review confirms ~46k min/yr savings landed

Cross-references

• Canonical change: hyperpolymath/standards#286
• Decision: hyperpolymath/standards#233 (Option B selected 2026-05-30)
• Prior cuts: standards#230 (cut 1), standards#231 (cut 2)
• Memory: session_2026_05_28_gh_actions_budget_cuts_1_2_3.md

[hyperpolymath]

cicd triage 2026-05-30: campaign progress check. Owner-decision (Option B) executed via #286 + #233; cross-estate fan-out remains the open work (~206 repos). Sweep paused on GH Actions budget — memory: project_estate_fake_action_sha_punch_list_2026_05_30 notes round-2 PR-creation deferred for the same reason. Resume next billing cycle. Leaving open with cicd label.

[hyperpolymath]

Restructure 2026-05-31 — separate standing recurring sweep from one-off fan-out

Per owner direction to split the campaign so #288 can close once the one-off work is done, the recurring/standing elements have been spun out into dedicated trackers:

• [standing] Estate CodeQL cron drift detection + 6-week budget review #323 — [standing] Estate CodeQL cron drift detection + 6-week budget review. Does not close. Owns the monthly re-audit for drift back to weekly, plus the ~2026-07-15 6-week budget delta.
• [campaign] Long-tail non-canonical CodeQL cron sweep (~86 files / 30 repos) #324 — [campaign] Long-tail non-canonical CodeQL cron sweep (~86 files / 30 repos). One-off follow-up for non-'0 6 * * 1' cadences that [campaign] Estate CodeQL weekly→monthly sweep (cut 3, standards#233 Option B — ~206 repos) #288 doesn't cover.

Audit 2026-05-31 (fresh, code-search backed)

Re-ran the estate audit via gh api search/code for org:hyperpolymath+filename:codeql.yml+cron + per-file fetch-and-classify:

Bucket	Files	Repos	Notes
'0 6 * * 1' weekly canonical	220	118	Scope of this campaign
'0 6 1 * *' monthly canonical	1	1	hyperpolymath/standards top-level (per #286)
Other cadences (long-tail)	86	30	Out of scope — moved to #324

The 220-file count (across 118 unique repos) is up from the 2026-05-28 baseline of ~206 — likely a mix of (a) monorepo subpath workflows the prior audit didn't enumerate and (b) ~14 weekly-cron drift entries that arrived since the original audit. Classification data in /tmp/codeql-audit/classified-merged.tsv (sweep machine).

Scope clarification for #288 (this issue)

In scope (one-off): convert '0 6 * * 1' → '0 6 1 * *' across 118 repos / 220 codeql.yml files. One PR per repo (each PR may touch multiple paths where the repo is a monorepo).

Out of scope (moved):

• Long-tail other cadences → [campaign] Long-tail non-canonical CodeQL cron sweep (~86 files / 30 repos) #324
• Monthly drift detection → [standing] Estate CodeQL cron drift detection + 6-week budget review #323
• 6-week budget review (~2026-07-15) → [standing] Estate CodeQL cron drift detection + 6-week budget review #323

Top per-repo file counts (informational)

Repo	Files
developer-ecosystem	37
asdf-tool-plugins	12
standards	10 (subpaths only — top-level already monthly)
julia-ecosystem	9
ssg-collection	8
patallm-gallery	7
ambientops	7
zotero-tools	6
reposystem	6
affinescript	3
(108 other repos)	1–2 each

Ownership-gate audit (clean)

All 118 candidate repos satisfy the per-PR ownership gate:

• owner == hyperpolymath ✅ (118/118)
• isFork == false ✅ (118/118)
• parent == null ✅ (118/118)
• archived == false ✅ (118/118)

No carve-outs needed — echo-types is not in the candidate list (no weekly-cron codeql.yml).

Execution

Sweep starting 2026-05-31 from this comment. Paced 6 min/PR (10 PRs/h) per the ~5 PRs / 30min secondary-rate-limit. Estimated ~12 hours background runtime.

• Script: /tmp/codeql-sweep.sh (extended to handle monorepo subpaths + clone repos that aren't locally checked out)
• Progress log: /tmp/codeql-sweep-progress.tsv (repo / status / pr / notes)
• PRs use the body shape: single-line cron diff, references GH Actions budget: cut 3 — CodeQL scheduled-run policy (pick a shape) #233 + [campaign] Estate CodeQL weekly→monthly sweep (cut 3, standards#233 Option B — ~206 repos) #288 + ci(codeql): canonical cron weekly→monthly (cut 3, standards#233 Option B) #286.
• Each PR has auto-merge SQUASH armed at creation.

This issue will close when the sweep completes and zero '0 6 * * 1' codeql.yml files remain in the estate.

[hyperpolymath]

Sweep launched 2026-05-31T07:12Z

Background fan-out running. 118 unique repos / 220 codeql.yml files in scope. 7 PRs already landed (1 manual seed + 6 from the early interactive batch). 111 remaining, paced at 6 min/PR.

Estimated completion: ~2026-05-31T18:33Z (~11h 20m).

What's running

• Driver: /tmp/codeql-audit/run-sweep.sh (PID file /tmp/codeql-audit/run-sweep.pid)
• Per-PR helper: /tmp/codeql-audit/sweep.sh — fresh-clones from origin into /tmp/codeql-sweep-work/<basename> (never touches local working trees — a 2026-05-31 audit found 125 of 291 local clones divergent from origin)
• Progress log: /tmp/codeql-audit/sweep-progress.tsv (TSV: repo / status / pr / notes)
• Run log: /tmp/codeql-audit/run-sweep.log

Safety properties

• ⚙️ Fresh clone per PR — guarantees the staged diff contains only the cron-line change.
• ⚙️ Staged-diff sanity check — script aborts on any unexpected path in git diff --cached --name-only.
• ⚙️ Idempotent — re-checks each file for the weekly cron line before editing; skips already-converted paths.
• ⚙️ Resume-aware — script reads sweep-progress.tsv and skips repos already marked ok/skip; can be relaunched safely.
• ⚙️ Per-repo ownership gate verified — all 118 candidates pre-checked owner=hyperpolymath, isFork=false, parent=null, archived=false.
• ⚙️ Auto-merge SQUASH armed at creation — each PR will land as the canonical change merges into the chain.

Early-batch PRs (filed interactively pre-launch)

Repo	PR
007	#30 — contains an unrelated SHA-pin update from a divergent local main; landed cleanly
a2ml_gleam	#30
a2ml-pre-commit	#18
a2ml-showcase	#28
a2ml-validate-action	#25
absolute-zero	#71
affinescript	#503 — monorepo, 3 paths edited

Closeout protocol

Once the sweep finishes:

1. Re-run audit (gh api search/code for '0 6 * * 1' in codeql.yml org-wide) — expect 0 hits.
2. Tally MERGED via gh pr list --search "head:ci/codeql-monthly-cron-288 author:@me" --state all --limit 200.
3. Comment closing stats on this issue + close.

Long-tail #324 and recurring drift #323 continue.