ci(codeql): cron weekly→monthly (cut 3, standards#233 Option B)

hyperpolymath · claude · hyperpolymath · commit 397c0202a297 · 2026-05-31T12:13:01.000+01:00
Per owner-decision Option B on hyperpolymath/standards#233 (2026-05-30): move scheduled CodeQL from weekly (`'0 6 * * 1'`) to monthly (`'0 6 1 * *'`). Same shape as canonical caller-template change in hyperpolymath/standards#286. ## Why - ~85% Actions-minute savings on scheduled CodeQL (12 runs/yr vs 52). - Bounded 30-day CVE-detection floor. - PR-trigger runs (push + pull_request) unchanged — every PR still gets CodeQL coverage. ## Sweep Part of estate-wide sweep tracked at hyperpolymath/standards#288. Refs hyperpolymath/standards#233 Refs hyperpolymath/standards#288 Refs hyperpolymath/standards#286 Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
@@ -7,7 +7,7 @@ on:
   pull_request:
     branches: [main, master]
   schedule:
-    - cron: '0 6 * * 1'
+    - cron: '0 6 1 * *'
 
 # Estate guardrail: cancel superseded runs so re-pushes / rebased PR
 # updates do not pile up queued runs against the shared account-wide
diff --git a/ada-ecosystem/ada-loom-registry/.github/workflows/codeql.yml b/ada-ecosystem/ada-loom-registry/.github/workflows/codeql.yml
@@ -7,7 +7,7 @@ on:
   pull_request:
     branches: [main, master]
   schedule:
-    - cron: '0 6 * * 1'
+    - cron: '0 6 1 * *'
 
 permissions: read-all
 
diff --git a/affinescript-ecosystem/rattlescript/affinescript/.github/workflows/codeql.yml b/affinescript-ecosystem/rattlescript/affinescript/.github/workflows/codeql.yml
@@ -7,7 +7,7 @@ on:
   pull_request:
     branches: [main, master]
   schedule:
-    - cron: '0 6 * * 1'
+    - cron: '0 6 1 * *'
 
 permissions: read-all
 
diff --git a/asdf-augmenters/asdf-control-tower/.github/workflows/codeql.yml b/asdf-augmenters/asdf-control-tower/.github/workflows/codeql.yml
@@ -6,7 +6,7 @@ on:
   pull_request:
     branches: [main]
   schedule:
-    - cron: "0 6 * * 1"
+    - cron: "0 6 1 * *"
 permissions: read-all
 jobs:
   analyze:
diff --git a/asdf-augmenters/asdf-plugin-collection/plugins/casket-ssg/.github/workflows/codeql.yml b/asdf-augmenters/asdf-plugin-collection/plugins/casket-ssg/.github/workflows/codeql.yml
@@ -6,7 +6,7 @@ on:
   pull_request:
     branches: [main]
   schedule:
-    - cron: "0 6 * * 1"
+    - cron: "0 6 1 * *"
 permissions: read-all
 jobs:
   analyze:
diff --git a/asdf-augmenters/asdf-plugin-collection/plugins/hashicorp/.github/workflows/codeql.yml b/asdf-augmenters/asdf-plugin-collection/plugins/hashicorp/.github/workflows/codeql.yml
@@ -6,7 +6,7 @@ on:
   pull_request:
     branches: [main]
   schedule:
-    - cron: "0 6 * * 1"
+    - cron: "0 6 1 * *"
 permissions: read-all
 jobs:
   analyze:
diff --git a/asdf-augmenters/asdf-plugin-collection/plugins/openlitespeed/.github/workflows/codeql.yml b/asdf-augmenters/asdf-plugin-collection/plugins/openlitespeed/.github/workflows/codeql.yml
@@ -7,7 +7,7 @@ on:
   pull_request:
     branches: [main, master]
   schedule:
-    - cron: '0 6 * * 1'
+    - cron: '0 6 1 * *'
 
 permissions: read-all
 
diff --git a/asdf-augmenters/asdf-security-plugin/.github/workflows/codeql.yml b/asdf-augmenters/asdf-security-plugin/.github/workflows/codeql.yml
@@ -7,7 +7,7 @@ on:
   pull_request:
     branches: [main, master]
   schedule:
-    - cron: '0 6 * * 1'
+    - cron: '0 6 1 * *'
 
 permissions: read-all
 
diff --git a/cadre-tea-router/.github/workflows/codeql.yml b/cadre-tea-router/.github/workflows/codeql.yml
@@ -7,7 +7,7 @@ on:
   pull_request:
     branches: [main, master]
   schedule:
-    - cron: '0 6 * * 1'
+    - cron: '0 6 1 * *'
 
 permissions: read-all
 
diff --git a/czech-file-knife/.github/workflows/codeql.yml b/czech-file-knife/.github/workflows/codeql.yml
@@ -7,7 +7,7 @@ on:
   pull_request:
     branches: [main, master]
   schedule:
-    - cron: '0 6 * * 1'
+    - cron: '0 6 1 * *'
 
 permissions: read-all
 
diff --git a/deno-ecosystem/.github/workflows/codeql.yml b/deno-ecosystem/.github/workflows/codeql.yml
@@ -7,7 +7,7 @@ on:
   pull_request:
     branches: [main, master]
   schedule:
-    - cron: '0 6 * * 1'
+    - cron: '0 6 1 * *'
 
 permissions: read-all
 
diff --git a/devkit-risc-v/.github/workflows/codeql.yml b/devkit-risc-v/.github/workflows/codeql.yml
@@ -7,7 +7,7 @@ on:
   pull_request:
     branches: [main, master]
   schedule:
-    - cron: '0 6 * * 1'
+    - cron: '0 6 1 * *'
 
 permissions: read-all
 
diff --git a/dnfinition/.github/workflows/codeql.yml b/dnfinition/.github/workflows/codeql.yml
@@ -7,7 +7,7 @@ on:
   pull_request:
     branches: [main, master]
   schedule:
-    - cron: '0 6 * * 1'
+    - cron: '0 6 1 * *'
 
 permissions: read-all
 
diff --git a/iser-tools/anvomidaviser/.github/workflows/codeql.yml b/iser-tools/anvomidaviser/.github/workflows/codeql.yml
@@ -7,7 +7,7 @@ on:
   pull_request:
     branches: [main, master]
   schedule:
-    - cron: '0 6 * * 1'
+    - cron: '0 6 1 * *'
 
 permissions:
   contents: read
diff --git a/iser-tools/betlangiser/.github/workflows/codeql.yml b/iser-tools/betlangiser/.github/workflows/codeql.yml
@@ -7,7 +7,7 @@ on:
   pull_request:
     branches: [main, master]
   schedule:
-    - cron: '0 6 * * 1'
+    - cron: '0 6 1 * *'
 
 permissions:
   contents: read
diff --git a/iser-tools/otpiser/.github/workflows/codeql.yml b/iser-tools/otpiser/.github/workflows/codeql.yml
@@ -7,7 +7,7 @@ on:
   pull_request:
     branches: [main, master]
   schedule:
-    - cron: '0 6 * * 1'
+    - cron: '0 6 1 * *'
 
 permissions:
   contents: read
diff --git a/rescript-ecosystem/cadre-router/.github/workflows/codeql.yml b/rescript-ecosystem/cadre-router/.github/workflows/codeql.yml
@@ -7,7 +7,7 @@ on:
   pull_request:
     branches: [main, master]
   schedule:
-    - cron: '0 6 * * 1'
+    - cron: '0 6 1 * *'
 
 permissions: read-all
 
diff --git a/rescript-ecosystem/idaptik-rescript13-staging/.github/workflows/codeql.yml b/rescript-ecosystem/idaptik-rescript13-staging/.github/workflows/codeql.yml
@@ -7,7 +7,7 @@ on:
   pull_request:
     branches: [main, master]
   schedule:
-    - cron: '0 6 * * 1'
+    - cron: '0 6 1 * *'
 
 permissions:
   contents: read
diff --git a/rescript-ecosystem/packages/bindings/openapi/.github/workflows/codeql.yml b/rescript-ecosystem/packages/bindings/openapi/.github/workflows/codeql.yml
@@ -7,7 +7,7 @@ on:
   pull_request:
     branches: [main]
   schedule:
-    - cron: '0 6 * * 1'
+    - cron: '0 6 1 * *'
 
 permissions: read-all
 
diff --git a/rescript-ecosystem/packages/bindings/tauri/.github/workflows/codeql.yml b/rescript-ecosystem/packages/bindings/tauri/.github/workflows/codeql.yml
@@ -7,7 +7,7 @@ on:
   pull_request:
     branches: [main, master]
   schedule:
-    - cron: '0 6 * * 1'
+    - cron: '0 6 1 * *'
 
 permissions: read-all
 
diff --git a/rescript-ecosystem/packages/core/early-return/.github/workflows/codeql.yml b/rescript-ecosystem/packages/core/early-return/.github/workflows/codeql.yml
@@ -7,7 +7,7 @@ on:
   pull_request:
     branches: [main, master]
   schedule:
-    - cron: '0 6 * * 1'
+    - cron: '0 6 1 * *'
 
 permissions: read-all
 
diff --git a/rescript-ecosystem/packages/core/poly-core/.github/workflows/codeql.yml b/rescript-ecosystem/packages/core/poly-core/.github/workflows/codeql.yml
@@ -7,7 +7,7 @@ on:
   pull_request:
     branches: [main, master]
   schedule:
-    - cron: '0 6 * * 1'
+    - cron: '0 6 1 * *'
 
 permissions: read-all
 
diff --git a/rescript-ecosystem/packages/core/runtime-tools/.github/workflows/codeql.yml b/rescript-ecosystem/packages/core/runtime-tools/.github/workflows/codeql.yml
@@ -7,7 +7,7 @@ on:
   pull_request:
     branches: [main, master]
   schedule:
-    - cron: '0 6 * * 1'
+    - cron: '0 6 1 * *'
 
 permissions: read-all
 
diff --git a/rescript-ecosystem/packages/ffi/zig-ffi/.github/workflows/codeql.yml b/rescript-ecosystem/packages/ffi/zig-ffi/.github/workflows/codeql.yml
@@ -6,7 +6,7 @@ on:
   pull_request:
     branches: [main]
   schedule:
-    - cron: '0 6 * * 1'
+    - cron: '0 6 1 * *'
 permissions: read-all
 jobs:
   analyze:
diff --git a/rescript-ecosystem/packages/tooling/alib-codemods/.github/workflows/codeql.yml b/rescript-ecosystem/packages/tooling/alib-codemods/.github/workflows/codeql.yml
@@ -7,7 +7,7 @@ on:
   pull_request:
     branches: [main, master]
   schedule:
-    - cron: '0 6 * * 1'
+    - cron: '0 6 1 * *'
 
 permissions: read-all
 
diff --git a/rescript-ecosystem/packages/tooling/alib-for-rescript/.github/workflows/codeql.yml b/rescript-ecosystem/packages/tooling/alib-for-rescript/.github/workflows/codeql.yml
@@ -7,7 +7,7 @@ on:
   pull_request:
     branches: [main, master]
   schedule:
-    - cron: '0 6 * * 1'
+    - cron: '0 6 1 * *'
 
 permissions: read-all
 
diff --git a/rescript-ecosystem/packages/tooling/create-poly/.github/workflows/codeql.yml b/rescript-ecosystem/packages/tooling/create-poly/.github/workflows/codeql.yml
@@ -7,7 +7,7 @@ on:
   pull_request:
     branches: [main, master]
   schedule:
-    - cron: '0 6 * * 1'
+    - cron: '0 6 1 * *'
 
 permissions: read-all
 
diff --git a/rescript-ecosystem/rescript-tea/.github/workflows/codeql.yml b/rescript-ecosystem/rescript-tea/.github/workflows/codeql.yml
@@ -7,7 +7,7 @@ on:
   pull_request:
     branches: [main, master]
   schedule:
-    - cron: '0 6 * * 1'
+    - cron: '0 6 1 * *'
 
 permissions:
   contents: read
diff --git a/rescript-ecosystem/rescript-vite/.github/workflows/codeql.yml b/rescript-ecosystem/rescript-vite/.github/workflows/codeql.yml
@@ -7,7 +7,7 @@ on:
   pull_request:
     branches: [main, master]
   schedule:
-    - cron: '0 6 * * 1'
+    - cron: '0 6 1 * *'
 
 permissions: read-all
 
diff --git a/riscv-guix-buildsys/.github/workflows/codeql.yml b/riscv-guix-buildsys/.github/workflows/codeql.yml
@@ -7,7 +7,7 @@ on:
   pull_request:
     branches: [main, master]
   schedule:
-    - cron: '0 6 * * 1'
+    - cron: '0 6 1 * *'
 
 permissions: read-all
 
diff --git a/scaffoldia/.github/workflows/codeql.yml b/scaffoldia/.github/workflows/codeql.yml
@@ -7,7 +7,7 @@ on:
   pull_request:
     branches: [main, master]
   schedule:
-    - cron: '0 6 * * 1'
+    - cron: '0 6 1 * *'
 
 permissions: read-all
 
diff --git a/techstack-enforcer/.github/workflows/codeql.yml b/techstack-enforcer/.github/workflows/codeql.yml
@@ -7,7 +7,7 @@ on:
   pull_request:
     branches: [main, master]
   schedule:
-    - cron: '0 6 * * 1'
+    - cron: '0 6 1 * *'
 
 permissions: read-all
 
diff --git a/v-ecosystem/v-benchmarks/.github/workflows/codeql.yml b/v-ecosystem/v-benchmarks/.github/workflows/codeql.yml
@@ -7,7 +7,7 @@ on:
   pull_request:
     branches: [main, master]
   schedule:
-    - cron: '0 6 * * 1'
+    - cron: '0 6 1 * *'
 
 permissions: read-all
 
diff --git a/v-ecosystem/v-grpc/.github/workflows/codeql.yml b/v-ecosystem/v-grpc/.github/workflows/codeql.yml
@@ -7,7 +7,7 @@ on:
   pull_request:
     branches: [main, master]
   schedule:
-    - cron: '0 6 * * 1'
+    - cron: '0 6 1 * *'
 
 permissions:
   contents: read
diff --git a/v-ecosystem/v-telemetry/.github/workflows/codeql.yml b/v-ecosystem/v-telemetry/.github/workflows/codeql.yml
@@ -7,7 +7,7 @@ on:
   pull_request:
     branches: [main, master]
   schedule:
-    - cron: '0 6 * * 1'
+    - cron: '0 6 1 * *'
 
 permissions: read-all
 
diff --git a/v-ecosystem/v_api_interfaces/v_grpc/.github/workflows/codeql.yml b/v-ecosystem/v_api_interfaces/v_grpc/.github/workflows/codeql.yml
@@ -7,7 +7,7 @@ on:
   pull_request:
     branches: [main, master]
   schedule:
-    - cron: '0 6 * * 1'
+    - cron: '0 6 1 * *'
 
 permissions: read-all
 
diff --git a/v-ecosystem/v_api_interfaces/v_rest/.github/workflows/codeql.yml b/v-ecosystem/v_api_interfaces/v_rest/.github/workflows/codeql.yml
@@ -7,7 +7,7 @@ on:
   pull_request:
     branches: [main, master]
   schedule:
-    - cron: '0 6 * * 1'
+    - cron: '0 6 1 * *'
 
 permissions: read-all
 
