Skip to content

[campaign] Estate CodeQL weekly→monthly sweep (cut 3, standards#233 Option B — ~206 repos) #288

Open
Open
[campaign] Estate CodeQL weekly→monthly sweep (cut 3, standards#233 Option B — ~206 repos)#288
Labels
cicdCI/CD: workflows, actions, lockfiles, pins, runners, release gatesmeta:campaignCoordinated multi-repo push with a defined end statepriority:p2Normal - queue itscope:estateAffects many or all repos across the estatestatus:blockedCannot proceed until a dependency clears

Description

@hyperpolymath
hyperpolymath
opened on May 30, 2026

Campaign overview

Per-repo fan-out of the canonical CodeQL cron change shipped in standards#286 (cut 3, owner-decision Option B 2026-05-30): convert ~206 repos from weekly ('0 6 * * 1') to monthly ('0 6 1 * *') CodeQL scheduled runs.

Why

Scope (audit 2026-05-28 + 2026-05-30)

Schedule Count Action
Weekly Monday 06:00 UTC ('0 6 * * 1') ~206 Convert to monthly via this sweep
Other weekly cadences ~15 Lower-priority follow-up
Already inline / non-reusable varies Out of scope for this sweep

Mechanical change per repo

 schedule:
-  - cron: '0 6 * * 1'   # weekly Monday 06:00 UTC
+  - cron: '0 6 1 * *'   # monthly 1st 06:00 UTC

PR-trigger runs (push + pull_request) unchanged — every PR still gets CodeQL.

Constraints

  • GitHub PR-create secondary rate-limit: ~5 PRs / 30min (operator memory).
  • Estimated total: 206 PRs × 6min stagger = ~21 hours of background sweep time.
  • Multi-session execution; resume by re-auditing repos still on '0 6 * * 1'.
  • Skip echo-types/ (owner hands-off).
  • Per-PR ownership gate: each repo must satisfy owner=hyperpolymath, isFork=false, parent=null.

Sequencing

  • ✅ Canonical change: standards#286 (OPEN, auto-merge armed 2026-05-30)
  • ⏳ Sweep execution: gated on canonical merging + the scorecard sweep standards#282 completing (to avoid rate-limit collision)
  • ⏳ Long-tail (~15 repos on non-canonical weekly cadences): follow-up after main sweep

Acceptance

  • 206 PRs land (or skipped where no-op)
  • Estate-wide CodeQL audit shows monthly cron everywhere or documented exception
  • 6-week budget review confirms ~46k min/yr savings landed

Cross-references

  • Canonical change: hyperpolymath/standards#286
  • Decision: hyperpolymath/standards#233 (Option B selected 2026-05-30)
  • Prior cuts: standards#230 (cut 1), standards#231 (cut 2)
  • Memory: session_2026_05_28_gh_actions_budget_cuts_1_2_3.md

Activity

  1. hyperpolymath
    added
    meta:campaignCoordinated multi-repo push with a defined end state
    cicdCI/CD: workflows, actions, lockfiles, pins, runners, release gates
    on May 30, 2026

  2. hyperpolymath commented on May 30, 2026

    @hyperpolymath
    hyperpolymath
    on May 30, 2026
    OwnerAuthor

    cicd triage 2026-05-30: campaign progress check. Owner-decision (Option B) executed via #286 + #233; cross-estate fan-out remains the open work (~206 repos). Sweep paused on GH Actions budget — memory: project_estate_fake_action_sha_punch_list_2026_05_30 notes round-2 PR-creation deferred for the same reason. Resume next billing cycle. Leaving open with cicd label.

  3. hyperpolymath commented on May 31, 2026

    @hyperpolymath
    hyperpolymath
    on May 31, 2026
    OwnerAuthor

    Restructure 2026-05-31 — separate standing recurring sweep from one-off fan-out

    Per owner direction to split the campaign so #288 can close once the one-off work is done, the recurring/standing elements have been spun out into dedicated trackers:

    Audit 2026-05-31 (fresh, code-search backed)

    Re-ran the estate audit via gh api search/code for org:hyperpolymath+filename:codeql.yml+cron + per-file fetch-and-classify:

    Bucket Files Repos Notes
    '0 6 * * 1' weekly canonical 220 118 Scope of this campaign
    '0 6 1 * *' monthly canonical 1 1 hyperpolymath/standards top-level (per #286)
    Other cadences (long-tail) 86 30 Out of scope — moved to #324

    The 220-file count (across 118 unique repos) is up from the 2026-05-28 baseline of ~206 — likely a mix of (a) monorepo subpath workflows the prior audit didn't enumerate and (b) ~14 weekly-cron drift entries that arrived since the original audit. Classification data in /tmp/codeql-audit/classified-merged.tsv (sweep machine).

    Scope clarification for #288 (this issue)

    In scope (one-off): convert '0 6 * * 1' → '0 6 1 * *' across 118 repos / 220 codeql.yml files. One PR per repo (each PR may touch multiple paths where the repo is a monorepo).

    Out of scope (moved):

    Top per-repo file counts (informational)

    Repo Files
    developer-ecosystem 37
    asdf-tool-plugins 12
    standards 10 (subpaths only — top-level already monthly)
    julia-ecosystem 9
    ssg-collection 8
    patallm-gallery 7
    ambientops 7
    zotero-tools 6
    reposystem 6
    affinescript 3
    (108 other repos) 1–2 each

    Ownership-gate audit (clean)

    All 118 candidate repos satisfy the per-PR ownership gate:

    • owner == hyperpolymath ✅ (118/118)
    • isFork == false ✅ (118/118)
    • parent == null ✅ (118/118)
    • archived == false ✅ (118/118)

    No carve-outs needed — echo-types is not in the candidate list (no weekly-cron codeql.yml).

    Execution

    Sweep starting 2026-05-31 from this comment. Paced 6 min/PR (10 PRs/h) per the ~5 PRs / 30min secondary-rate-limit. Estimated ~12 hours background runtime.

    This issue will close when the sweep completes and zero '0 6 * * 1' codeql.yml files remain in the estate.

  4. hyperpolymath commented on May 31, 2026

    @hyperpolymath
    hyperpolymath
    on May 31, 2026
    OwnerAuthor

    Sweep launched 2026-05-31T07:12Z

    Background fan-out running. 118 unique repos / 220 codeql.yml files in scope. 7 PRs already landed (1 manual seed + 6 from the early interactive batch). 111 remaining, paced at 6 min/PR.

    Estimated completion: ~2026-05-31T18:33Z (~11h 20m).

    What's running

    • Driver: /tmp/codeql-audit/run-sweep.sh (PID file /tmp/codeql-audit/run-sweep.pid)
    • Per-PR helper: /tmp/codeql-audit/sweep.sh — fresh-clones from origin into /tmp/codeql-sweep-work/<basename> (never touches local working trees — a 2026-05-31 audit found 125 of 291 local clones divergent from origin)
    • Progress log: /tmp/codeql-audit/sweep-progress.tsv (TSV: repo / status / pr / notes)
    • Run log: /tmp/codeql-audit/run-sweep.log

    Safety properties

    • ⚙️ Fresh clone per PR — guarantees the staged diff contains only the cron-line change.
    • ⚙️ Staged-diff sanity check — script aborts on any unexpected path in git diff --cached --name-only.
    • ⚙️ Idempotent — re-checks each file for the weekly cron line before editing; skips already-converted paths.
    • ⚙️ Resume-aware — script reads sweep-progress.tsv and skips repos already marked ok/skip; can be relaunched safely.
    • ⚙️ Per-repo ownership gate verified — all 118 candidates pre-checked owner=hyperpolymath, isFork=false, parent=null, archived=false.
    • ⚙️ Auto-merge SQUASH armed at creation — each PR will land as the canonical change merges into the chain.

    Early-batch PRs (filed interactively pre-launch)

    Repo PR
    007 #30 — contains an unrelated SHA-pin update from a divergent local main; landed cleanly
    a2ml_gleam #30
    a2ml-pre-commit #18
    a2ml-showcase #28
    a2ml-validate-action #25
    absolute-zero #71
    affinescript #503 — monorepo, 3 paths edited

    Closeout protocol

    Once the sweep finishes:

    1. Re-run audit (gh api search/code for '0 6 * * 1' in codeql.yml org-wide) — expect 0 hits.
    2. Tally MERGED via gh pr list --search "head:ci/codeql-monthly-cron-288 author:@me" --state all --limit 200.
    3. Comment closing stats on this issue + close.

    Long-tail #324 and recurring drift #323 continue.

  5. hyperpolymath
    added 10 commits that reference this issue on May 31, 2026

    ci(codeql): cron weekly→monthly (cut 3, standards#233 Option B) (#71)

    7dccd56

    ci(codeql): cron weekly→monthly (cut 3, standards#233 Option B) (#503)

    a5e0fb1

    ci(codeql): cron weekly→monthly (cut 3, standards#233 Option B) (#156)

    8619fbf

    ci(codeql): cron weekly→monthly (cut 3, standards#233 Option B) (#39)

    9fbfbfe

    ci(codeql): cron weekly→monthly (cut 3, standards#233 Option B) (#26)

    4e024c6

    ci(codeql): cron weekly→monthly (cut 3, standards#233 Option B) (#26)

    5915403

    ci(codeql): cron weekly→monthly (cut 3, standards#233 Option B) (#50)

    f4fa316

    ci(codeql): cron weekly→monthly (cut 3, standards#233 Option B) (#52)

    a039c32

    ci(codeql): cron weekly→monthly (cut 3, standards#233 Option B) (#34)

    b200b10

    ci(codeql): cron weekly→monthly (cut 3, standards#233 Option B) (#26)

    bd88b14

  6. 60 remaining items

  7. hyperpolymath
    added 3 commits that reference this issue on Jun 24, 2026

    ci(codeql): cron weekly→monthly (cut 3, standards#288) (#67)

    2d0b319

    ci(codeql): cron weekly→monthly (cut 3, standards#288) (#54)

    b14a8c5

    ci(codeql): cron weekly→monthly (cut 3, standards#288) (#241)

    ecbeaac
  8. hyperpolymath
    added a commit that references this issue on Jul 1, 2026

    ci(codeql): cron weekly→monthly (cut 3, standards#288) (#125)

    ee84b37
  9. hyperpolymath
    added 4 commits that reference this issue on Jul 29, 2026

    ci(codeql): cron weekly→monthly (cut 3, standards#288) (#146)

    a9cfa26

    ci(codeql): cron weekly→monthly (cut 3, standards#288) (#212)

    d272539

    ci(codeql): cron weekly→monthly (cut 3, standards#288) (#62)

    7ec21ae

    ci(codeql): cron weekly→monthly (cut 3, standards#288) (#127)

    136a67b

  10. hyperpolymath commented on Aug 25, 2026

    @hyperpolymath
    hyperpolymath
    on Aug 25, 2026
    OwnerAuthor

    2026-08-25 — sweep is demonstrably incomplete

    18 of 60 sampled repos are still on the old 0 6 * * 1 cron: empty-linter, plasma-parser-writer, kitchenspeak, session-sentinel, bitfuckit, laminar, proof-of-work, snapcreate, valence-shell, trope-checker, and others.

    Horizon: 60-repo sample, not the full ~206. The remaining tail is unmeasured — the real figure is at least 18, not exactly 18.

    Verified 2026-08-25.

  11. hyperpolymath commented on Aug 27, 2026

    @hyperpolymath
    hyperpolymath
    on Aug 27, 2026
    OwnerAuthor

    Re-measured 2026-08-27 — the estimate is wrong in both directions

    Both prior figures (body ~206 repos; the 05-31 comment 220 files / 118 repos) were gh api search/code-bounded, and code search caps silently. Enumerate-then-filter over 420 repos:

    measured
    CodeQL workflow files estate-wide 1,046 across 355 repos
    still on '0 6 * * 1' (weekly) 642 files / 168 repos
    already on '0 6 1 * *' (monthly) 202 files / 143 repos
    of the 642, root-level 146

    ⚠️ The arithmetic that matters

    496 of the 642 are monorepo subpaths — asdf-tool-plugins (207) and developer-ecosystem (124) alone hold 331. GitHub only executes workflows at the repo root, so those cost nothing and rewriting them saves nothing.

    So "206 PRs × 6 min = 21 hours" is wrong twice over: 168 repos need a PR, but two monorepo PRs clear half the files — and half the files were never costing anything.

    The canonical #286 is MERGED (2026-05-30), so the pattern to propagate exists.

    Recommend: rescope to the 146 root-level files and re-derive the savings estimate.

  12. hyperpolymath
    added 2 commits that reference this issue on Aug 31, 2026

    ci(codeql): cron weekly→monthly (cut 3, standards#288)

    ae63db1

    ci(codeql): cron weekly→monthly (cut 3, standards#288)

    8b88e20
  13. hyperpolymath
    added
    priority:p2Normal - queue it
    scope:estateAffects many or all repos across the estate
    status:blockedCannot proceed until a dependency clears
    on Sep 30, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    cicdCI/CD: workflows, actions, lockfiles, pins, runners, release gatesmeta:campaignCoordinated multi-repo push with a defined end statepriority:p2Normal - queue itscope:estateAffects many or all repos across the estatestatus:blockedCannot proceed until a dependency clears

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions