[campaign] Long-tail non-canonical CodeQL cron sweep (~86 files / 30 repos)

[hyperpolymath]

Background

Spun out of #288. The cut-3 main sweep covers ~118 repos / 220 files on the canonical weekly cron '0 6 * * 1'. The 2026-05-31 audit also found 86 codeql.yml files across 30 repos on non-canonical weekly cadences — these are out of scope for #288 (which is strictly '0 6 * * 1' → '0 6 1 * *') but worth a follow-up sweep for consistency + savings.

Audit (2026-05-31)

Long-tail cadences and their file counts:

Cron	Files	Note
42 20 * * 0 (Sunday 20:42)	33	GitHub-default CodeQL setup wizard cron
16 7 * * 1 (Monday 07:16)	12	Likely a prior scaffold variant
0 0 * * 1 (Monday 00:00)	5
0 6 * * * (daily 06:00)	3	Daily — much higher cost
37 13 * * 0 (Sunday 13:37)	3
36 15 * * 6 (Saturday 15:36)	3
19 20 * * * (daily 20:19)	1	Daily
0 0 * * * (daily midnight)	1	Daily
21 other singleton/pair cadences	~25	Various ad-hoc

Full list in /tmp/codeql-audit/classified-merged.tsv (sweep machine, 2026-05-31).

Mechanical change per file

Same shape as #288:

 schedule:
-  - cron: '<existing weekly/daily cron>'
+  - cron: '0 6 1 * *'   # monthly 1st 06:00 UTC

PR-trigger runs (push + pull_request) unchanged.

Why follow-up not bundled into #288

• [campaign] Estate CodeQL weekly→monthly sweep (cut 3, standards#233 Option B — ~206 repos) #288 has a tightly-scoped acceptance criterion ('0 6 * * 1' only). Bundling expands scope and complicates closure.
• The 3 daily files are higher-priority than the weekly cadences (~7× the cost) — should land first.
• Some non-canonical cadences may be intentional (e.g. coordinated with another scheduled job to avoid contention). Per-repo sanity-check before bulk fan-out.

Estimated savings

If all 86 files converted to monthly:

• 5 daily files × 365 runs → 12 = ~1,765 fewer runs/yr
• ~78 weekly files × 52 → 12 = ~3,120 fewer runs/yr
• Total ~4,885 fewer scheduled CodeQL runs/yr × ~5min = 24,425 min/yr ($200/yr equivalent)

(Smaller than #288's ~46k min/yr because the file count is smaller, but the per-file savings on the daily ones is much higher.)

Sequencing

Gate on #288 main sweep landing (avoid PR-create rate-limit collision):

• ⏳ Wait for [campaign] Estate CodeQL weekly→monthly sweep (cut 3, standards#233 Option B — ~206 repos) #288 to close
• Pilot: 3 daily files first (highest-cost, lowest-risk)
• Sweep: remaining 81 files, paced at 5 PRs / 30min

Cross-references

• Parent campaign: [campaign] Estate CodeQL weekly→monthly sweep (cut 3, standards#233 Option B — ~206 repos) #288
• Recurring sweep: [standing] Estate CodeQL cron drift detection + 6-week budget review #323
• Decision: GH Actions budget: cut 3 — CodeQL scheduled-run policy (pick a shape) #233 (Option B)
• Audit data: /tmp/codeql-audit/classified-merged.tsv (sweep machine 2026-05-31)

Acceptance

• 86 files converted to monthly (or documented exception for any kept on a different cadence)
• Estate-wide audit shows only '0 6 1 * *' or documented exception

[hyperpolymath]

Re-audit 2026-06-02 — corrected: 17 (not 86), no daily

Fresh audit just ran (/tmp/codeql-longtail/ — 359 owner non-fork repos queried in parallel against /.github/workflows/codeql.yml via gh api .../contents). Current cadence histogram:

Cadence	Repos	Notes
0 6 * * 1 (canonical weekly)	208	Target of #288's running sweep
0 6 1 * * (canonical monthly)	50	Already done (sweep landings + manual)
Non-canonical (this issue's scope)	17	See below

The 86-file figure from the 2026-05-31 audit was inflated by counting codeql.yml across branches/refs in code-search results (per the stalled-agent observation "multiple hits per repo"). One repo = one cadence is the accurate framing.

Non-canonical breakdown (17 repos)

Cron	Repo(s)
0 0 * * 1 (Mon midnight)	casket-ssg, ProvenCrypto.jl
16 7 * * 1 (Mon 07:16)	bebop-ffi, befunge93-vault-cracker
42 20 * * 0 (Sun 20:42 — wizard default)	anvomidav, coq-jr
11 ad-hoc singletons	avow-protocol, qubes-sdp, project-wharf, blocky-writer, resource-record-fluctuator, bag-of-actions, social-media-polygraph, idaptik-dlc-reversibley, nextgen-language-evangeliser, vcs-ircd, safe-brute-force

Critical: NO daily crons

The 2026-05-31 audit reported "5 daily files (~7× cost)". Today's re-audit finds zero daily — they may have been resolved in the prior sweep before interruption, or were never present (mis-counted via the same branch-refs artifact).

Proposed action

The 17 are content-trivial — convert any cron → 0 6 1 * * with a per-repo PR. All 17 are owner-authored repos, no third-party / fork concerns. Title pattern ci(codeql): cron <existing>→monthly (cut 3 long-tail, standards#324) is compatible with the post-2026-06-02 PR-sweep keyword exclusion rule.

Execution: queue these for after #288's main sweep completes (~26h from 13:08Z). At 7-min cadence, the long-tail adds ~2h. Or land inline after the main sweep clears. Will report back when the main sweep finishes.

Co-Authored-By: Claude Opus 4.7 (1M context) noreply@anthropic.com

[hyperpolymath]

2026-08-25 — all three named exemplars unchanged

casket-ssg 0 0 * * 1 · coq-jr 42 20 * * 0 · bebop-ffi 16 7 * * 1. Roughly 10 of 60 sampled repos remain on non-canonical crons.

Related: #323 is the standing drift tracker, and #633 child 5 proposes the mechanism this family keeps needing — turning findings into issues automatically instead of hand-run sweeps.

Verified 2026-08-25.

[hyperpolymath]

Re-measured 2026-08-27 — four corrections, and the pilot plan is moot

Measured by fetching and grepping all 349 root-level .github/workflows/*codeql*.yml blobs across 348 repos:

0 6 * * 1   146      0 6 1 * *   140      0 0 * * 0    41
long tail    22 files across 18 cadences      no cron     3

claim	measured
"3–5 daily files, highest cost — pilot these first"	❌ no daily crons remain at all; the pilot plan is moot
42 20 * * 0 — 33 files	❌ 2 files
non-canonical total 86 files	❌ 63
—	⚠️ the largest non-canonical cluster is 0 0 * * 0 at 41 files, which this issue never lists

⚠️ Two facts that change the savings arithmetic

• 697 of the 1,046 CodeQL workflow files in the estate are nested inside vendored subdirectories — asdf-tool-plugins 219, developer-ecosystem 168, polystack 74, ssg-collection 68, standards 35. GitHub only executes workflows at the repo root, so these cost nothing and rewriting them saves nothing.
• The stated gate, [campaign] Estate CodeQL weekly→monthly sweep (cut 3, standards#233 Option B — ~206 repos) #288, is still OPEN, with 146 files still on its own target cron.

Recommend: rewrite the target table against the four real clusters, and re-derive the savings from root-level files only.