GH Actions budget: cut 3 — CodeQL scheduled-run policy (pick a shape)

[hyperpolymath]

Background

Cut 3 of the GH Actions budget rebalancing plan (2026-05-27). Builds on PR #230 (scorecard example fix, MERGED) and issue #231 (scorecard daily→weekly fan-out, in pilot).

Estate CodeQL state (audit 2026-05-28)

Schedule	Count	Notes
Weekly Monday 06:00 UTC ('0 6 * * 1')	206	Canonical
Other weekly cadences	~15	Mostly stragglers, low priority

So unlike scorecard (180 daily) where the cut was schedule-frequency, CodeQL is already on weekly estate-wide. The cut here is a different axis: whether to keep scheduled CodeQL at all, and on which repos.

Budget math

Rough numbers:

• 206 repos × 52 runs/year × ~5 min/run (CodeQL is multi-minute, often longer with matrix) = ~53,560 Actions-minutes/year on scheduled CodeQL alone
• Plus PR-trigger runs (kept regardless of this cut)
• Self-hosted runner option (separate cut, plan item chore(deps): bump the actions group across 1 directory with 4 updates #8) could take all of this to zero

Three shapes

Each is a different point on the security-vs-savings curve:

Option A: Drop scheduled CodeQL entirely

 on:
   push:
     branches: [main, master]
   pull_request:
     branches: [main, master]
-  schedule:
-    - cron: '0 6 * * 1'

Savings: ~53.5k Actions-min/year (~100% of scheduled CodeQL).
Risk: A vulnerable dep that lands sits undetected by CodeQL until the next PR-trigger. For many estate repos that's fine (PR cadence high enough). For dormant security-critical repos (e.g. crypto / auth / supply-chain libs) it's a real lag.
When this is right: most repos are doc/template/scaffold/exploration — scheduled CodeQL on them catches near-zero real findings vs the cost.

Option B: Move to monthly

   schedule:
-    - cron: '0 6 * * 1'
+    - cron: '0 6 1 * *'   # Monthly, 1st of month, 06:00 UTC

Savings: ~46k Actions-min/year (~85% of scheduled CodeQL: 12 runs/year vs 52).
Risk: CVE lag bounded to ~30 days for any repo, regardless of PR cadence.
When this is right: middle ground; preserves periodic-floor without weekly cost.

Option C: Allowlist (drop schedule for non-shipping repos)

Keep weekly CodeQL on ~20 shipping/security-sensitive repos (e.g. panll, gossamer, burble, hypatia, verisimdb, boj-server, affinescript, ephapax, typed-wasm, proven, standards, vcl-ut, etc.); drop scheduled CodeQL on the ~186 doc/template/scaffold/exploration repos.

Mechanical shape: an opt-in label topic:codeql-scheduled (or a per-repo file .well-known/codeql-scheduled) gates the schedule block. The canonical CodeQL reusable wrapper template (in standards/.github/workflows/codeql.yml) drops the schedule block by default; shipping repos either keep their per-repo schedule block intact or opt in via the marker.

Savings: ~45.5k Actions-min/year (~85% of scheduled CodeQL: 20 × 52 = 1,040 runs/year vs 206 × 52 = 10,712).
Risk: scheduled CodeQL kept on the repos that materially benefit from it; dropped on the rest.
When this is right: estate has a strong shipping-vs-template split (it does — see .machine_readable/META.a2ml repo classifications), so the allowlist is honest about where the value is.

Comparison table

Shape	Savings (min/year)	Estate-wide CodeQL coverage	Selection cost
A — drop schedule	~53.5k (100%)	PR-trigger only on all 206	None — single canonical diff
B — monthly	~46k (~85%)	All 206 monthly	None — single canonical diff
C — allowlist	~45.5k (~85%)	Weekly on ~20, PR-trigger on the rest	Per-repo decision for the ~20

Note A's slightly-higher savings come at materially-higher CVE-lag risk; B and C are within rounding error on savings but differ in where the coverage lands.

Recommendation request

Owner to pick:

• Option A — drop scheduled CodeQL entirely
• Option B — move to monthly
• Option C — allowlist (keep weekly on shipping repos, drop on the rest)
• Hybrid / other — describe

Execution path (post-decision)

For all three options, the upstream change is to standards/.github/workflows/codeql.yml (the canonical caller template); fan-out then converts the ~206 weekly repos to the chosen pattern. Single-line cron change shape (same as cut 1/2), AM001-class admin-mergeable, can ride the same pilot+sweep approach proven in issue #231.

Related

• PR #230 — scorecard cut 1 (MERGED)
• Issue #231 — scorecard cut 2 (pilot wave landed 2026-05-28)
• GH-Actions budget rebalancing plan 2026-05-27 (session_2026_05_27_doomed_ci_pilot family of memory notes)
• Plan item chore(deps): bump the actions group across 1 directory with 4 updates #8 (self-hosted runner for hypatia-scan + CodeQL) — orthogonal complement to this cut; takes both to zero GH Actions minutes

🤖 Generated with Claude Code

[hyperpolymath]

Decision: Option B — move scheduled CodeQL to monthly ('0 6 1 * *').

Why B

• 85% savings (~46k min/yr) without an estate-wide stratification exercise (avoids the per-repo decision cost of C and the worst-case CVE-lag risk of A).
• Bounded 30-day floor for every repo, regardless of activity level.
• Single mechanical fan-out — same shape as cuts 1+2.
• Cadence aligns with the CVE→CodeQL-query propagation cycle (practical detection delta vs weekly is small).

Execution plan

1. Canonical change — single-line cron in standards/.github/workflows/codeql.yml:

    schedule:
   -  - cron: '0 6 * * 1'   # weekly Monday 06:00 UTC
   +  - cron: '0 6 1 * *'   # monthly 1st 06:00 UTC

2. Sweep — ~206 repos on the canonical weekly cron get the same edit. Same AM001-class admin-merge eligibility as cuts 1+2. Stagger per the GitHub secondary-rate-limit cadence (~5 PRs / 30min).
3. Long-tail — the ~15 repos on other weekly cadences are lower priority; revisit in a follow-up.

Follow-ups

• Track sweep PRs under a separate sub-issue (file when execution begins).
• Self-hosted runner option (plan item chore(deps): bump the actions group across 1 directory with 4 updates #8) is orthogonal and can layer on after this lands.

[hyperpolymath]

Owner Option B executed 2026-05-30:

• Canonical change: ci(codeql): canonical cron weekly→monthly (cut 3, standards#233 Option B) #286 (auto-merge SQUASH armed)
• Estate sweep tracker: [campaign] Estate CodeQL weekly→monthly sweep (cut 3, standards#233 Option B — ~206 repos) #288 (~206 repos)

Sweep execution is gated on (a) #286 merging and (b) the parallel scorecard sweep #282 completing — to avoid GitHub PR-create secondary rate-limit collision. Multi-session backlog (~21 hours of background sweep time at 6-min stagger).

[hyperpolymath]

Owner-decision discharged 2026-05-30 (per the prior comment trail): Option B selected, canonical change shipped via #286, estate sweep tracked under #288. Closing this decision ticket; sweep continues in #288.