feat(scripts): 5 fix scripts for hypatia WF024 chapel + WF025 cron-drift (#251)

Companion to hypatia#422. Implements the auto-fix side. License-category
remains disabled per #247.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

scripts/fix-chapel-chpl-llvm-export.sh

@@ -0,0 +1,40 @@
+#!/bin/bash
+# SPDX-License-Identifier: MPL-2.0
+#
+# fix-chapel-chpl-llvm-export.sh — ensure CHPL_LLVM is exported on Chapel jobs
+#
+# Driven by hypatia WF024 (chapel-chpl-llvm-export recipe). Sharp edge #2 in
+# panic-attack wiki Chapel-Metalayer.md: CHPL_LLVM is required by `chpl`'s
+# diagnostic + build steps; unset means the toolchain falls back to a different
+# code path that doesn't link against libllvm14 (the .deb's only supported
+# binding).
+#
+# Inserts `export CHPL_LLVM=bundled` (the only supported value for the
+# precompiled .deb path) into the install step.
+#
+# Idempotent.
+
+set -euo pipefail
+
+REPO_PATH="$1"
+FINDING_FILE="${2:-}"
+
+cd "$REPO_PATH"
+
+CHANGED=0
+for f in $(find .github/workflows -name '*.yml' -o -name '*.yaml' 2>/dev/null); do
+  if ! grep -qE 'CHAPEL_DEB_URL|chapel-[0-9]+\.[0-9]+' "$f"; then
+    continue
+  fi
+  if grep -qE 'CHPL_LLVM[[:space:]]*=' "$f"; then
+    continue   # already exported / set
+  fi
+  if grep -qE 'chpl --version|sudo apt-get install.*chapel' "$f"; then
+    sed -i -E '0,/(chpl --version|sudo apt-get install.*chapel)/{s|^([[:space:]]*)(chpl --version\|sudo apt-get install.*chapel)|\1export CHPL_LLVM=bundled\n\1\2|}' "$f"
+    echo "  CHPL_LLVM=bundled exported: $f"
+    CHANGED=$((CHANGED + 1))
+  fi
+done
+
+echo "fix-chapel-chpl-llvm-export: $CHANGED change(s) applied"
+exit 0

scripts/fix-chapel-manpath-guard.sh

@@ -0,0 +1,38 @@
+#!/bin/bash
+# SPDX-License-Identifier: MPL-2.0
+#
+# fix-chapel-manpath-guard.sh — guard against unset MANPATH on Chapel install
+#
+# Driven by hypatia WF024 (chapel-manpath-guard recipe). One of the 5 sharp
+# edges in panic-attack wiki Chapel-Metalayer.md: the chpl install step
+# references $MANPATH unconditionally; unset MANPATH explodes under `set -u`.
+#
+# Inserts `: \${MANPATH:=}` BEFORE the chapel install runs.
+#
+# Idempotent.
+
+set -euo pipefail
+
+REPO_PATH="$1"
+FINDING_FILE="${2:-}"
+
+cd "$REPO_PATH"
+
+CHANGED=0
+for f in $(find .github/workflows -name '*.yml' -o -name '*.yaml' 2>/dev/null); do
+  if ! grep -qE 'CHAPEL_DEB_URL|chapel-[0-9]+\.[0-9]+' "$f"; then
+    continue
+  fi
+  if grep -qF ': ${MANPATH:=}' "$f"; then
+    continue   # already guarded
+  fi
+  # Insert guard before the first `chpl --version` or chapel install line
+  if grep -qE 'chpl --version|sudo apt-get install.*chapel' "$f"; then
+    sed -i -E '0,/(chpl --version|sudo apt-get install.*chapel)/{s|^([[:space:]]*)(chpl --version\|sudo apt-get install.*chapel)|\1: ${MANPATH:=}\n\1\2|}' "$f"
+    echo "  MANPATH guard inserted: $f"
+    CHANGED=$((CHANGED + 1))
+  fi
+done
+
+echo "fix-chapel-manpath-guard: $CHANGED change(s) applied"
+exit 0

scripts/fix-chapel-replace-chpl-about.sh

@@ -0,0 +1,35 @@
+#!/bin/bash
+# SPDX-License-Identifier: MPL-2.0
+#
+# fix-chapel-replace-chpl-about.sh — replace dropped `chpl --about` with
+# the 2.8-compatible equivalent.
+#
+# Driven by hypatia WF024 (chapel-replace-chpl-about-with-version recipe).
+# Sharp edge #3 in panic-attack wiki Chapel-Metalayer.md: `chpl --about` was
+# removed in Chapel 2.8 — workflows that rely on it for diagnostic output
+# break silently (no `--about` flag is a no-op + exits 0 on some versions).
+#
+# Replace with `chpl --version && printchplenv` which gives the same
+# information across the 2.7/2.8 split.
+#
+# Idempotent.
+
+set -euo pipefail
+
+REPO_PATH="$1"
+FINDING_FILE="${2:-}"
+
+cd "$REPO_PATH"
+
+CHANGED=0
+for f in $(find .github/workflows -name '*.yml' -o -name '*.yaml' 2>/dev/null); do
+  if ! grep -qF 'chpl --about' "$f"; then
+    continue
+  fi
+  sed -i 's|chpl --about|chpl --version \&\& printchplenv|g' "$f"
+  echo "  chpl --about → chpl --version && printchplenv: $f"
+  CHANGED=$((CHANGED + 1))
+done
+
+echo "fix-chapel-replace-chpl-about: $CHANGED change(s) applied"
+exit 0

scripts/fix-chapel-runs-on-pin.sh

@@ -0,0 +1,42 @@
+#!/bin/bash
+# SPDX-License-Identifier: MPL-2.0
+#
+# fix-chapel-runs-on-pin.sh — pin runs-on: ubuntu-22.04 on any Chapel-using job
+#
+# Driven by hypatia WF024 (chapel-runs-on-pin-22-04 recipe). The Chapel-2.8.0
+# .deb (chapel-X.Y.Z-N.ubuntu22.amd64.deb) is ABI-linked to libclang-cpp.so.14
+# / LLVM-14 — only present on Ubuntu 22.04. ubuntu-latest / ubuntu-24.04
+# resolves the unmet dep with libclang-cpp-18 → `chpl` exit 127 at startup.
+#
+# Idempotent: skips files already pinned to ubuntu-22.04.
+
+set -euo pipefail
+
+REPO_PATH="$1"
+FINDING_FILE="${2:-}"
+
+cd "$REPO_PATH"
+
+CHANGED=0
+for f in $(find .github/workflows -name '*.yml' -o -name '*.yaml' 2>/dev/null); do
+  # Only patch files that actually reference Chapel
+  if ! grep -qE 'CHAPEL_DEB_URL|chapel-[0-9]+\.[0-9]+\.[0-9]+-[0-9]+\.ubuntu22|chpl --(version|about)|printchplenv' "$f"; then
+    continue
+  fi
+
+  if grep -qE '^[[:space:]]+runs-on:[[:space:]]+ubuntu-latest' "$f"; then
+    sed -i -E 's|^([[:space:]]+)runs-on:[[:space:]]+ubuntu-latest|\1runs-on: ubuntu-22.04|' "$f"
+    echo "  pinned ubuntu-22.04: $f"
+    CHANGED=$((CHANGED + 1))
+  fi
+
+  # Also normalise the apt install pattern (declarative resolution beats dpkg+fix loop)
+  if grep -qF 'sudo dpkg -i /tmp/chapel.deb || sudo apt-get install -f -y' "$f"; then
+    sed -i 's|sudo dpkg -i /tmp/chapel.deb || sudo apt-get install -f -y|sudo apt-get install -y /tmp/chapel.deb|' "$f"
+    echo "  apt-get install replaces dpkg fallback: $f"
+    CHANGED=$((CHANGED + 1))
+  fi
+done
+
+echo "fix-chapel-runs-on-pin: $CHANGED change(s) applied in $REPO_PATH"
+exit 0

scripts/fix-codeql-cron-monthly.sh

@@ -0,0 +1,51 @@
+#!/bin/bash
+# SPDX-License-Identifier: MPL-2.0
+#
+# fix-codeql-cron-monthly.sh — convert codeql.yml cron to canonical monthly
+#
+# Driven by hypatia WF025 (codeql-cron-monthly recipe). Per standards#286
+# (Option B 2026-05-30 estate decision): CodeQL schedule monthly canonical
+# `0 6 1 * *`. PR-trigger runs unchanged.
+#
+# Handles both #288-shape (weekly `0 6 * * 1` → monthly) and #324-shape
+# (any non-canonical cron → monthly).
+#
+# Idempotent: skips files already on canonical monthly.
+
+set -euo pipefail
+
+REPO_PATH="$1"
+FINDING_FILE="${2:-}"
+
+cd "$REPO_PATH"
+
+F=".github/workflows/codeql.yml"
+if [[ ! -f "$F" ]]; then
+  echo "fix-codeql-cron-monthly: no $F in $REPO_PATH"
+  exit 0
+fi
+
+if grep -qF "cron: '0 6 1 * *'" "$F"; then
+  echo "fix-codeql-cron-monthly: already canonical monthly: $F"
+  exit 0
+fi
+
+python3 - <<PY
+import re, sys
+p = "$F"
+content = open(p).read()
+new, n = re.subn(
+    r"(^[ \t]*-[ \t]*cron:[ \t]*)'[^']+'(.*)",
+    r"\1'0 6 1 * *'   # monthly 1st 06:00 UTC",
+    content,
+    count=1,
+    flags=re.MULTILINE,
+)
+if n == 0:
+    print("fix-codeql-cron-monthly: no cron line found in", p)
+    sys.exit(0)
+open(p, "w").write(new)
+print(f"fix-codeql-cron-monthly: 1 cron line replaced in", p)
+PY
+
+exit 0

scripts/fix-script-registry.json

@@ -97,7 +97,12 @@
       "recipe-add-feedback-integration": "fix-missing-feedback-integration.sh",
       "recipe-add-vexometer-hooks": "fix-missing-vexometer-hooks.sh",
       "recipe-remove-tracked-package-lock": "fix-tracked-package-lock.sh",
-      "cicd_rules/tracked_npm_lockfile": "fix-tracked-package-lock.sh"
+      "cicd_rules/tracked_npm_lockfile": "fix-tracked-package-lock.sh",
+      "chapel-runs-on-pin-22-04": "fix-chapel-runs-on-pin.sh",
+      "codeql-cron-monthly": "fix-codeql-cron-monthly.sh",
+      "chapel-manpath-guard": "fix-chapel-manpath-guard.sh",
+      "chapel-chpl-llvm-export": "fix-chapel-chpl-llvm-export.sh",
+      "chapel-replace-chpl-about-with-version": "fix-chapel-replace-chpl-about.sh"
     }
   }
 }