hypatia: detect duplicate cron triggers on the same day-of-week (from #333 cohort, pattern 3)

[hyperpolymath]

Detector spec (from hypatia#333 Pattern 3)

Pattern 3 — Workflow has multiple cron: entries firing on the same day-of-week

Severity: medium (runner-cost waste, log noise)

Detection (Hypatia.Rules.CicdRules — cicd_waste_detection):

• Parse on.schedule[].cron strings.
• Group by the day-of-week field (5th cron position). If 2+ entries fire on the same day-of-week (incl. *), flag with the entries' minutes/hours.
• Special case: if one entry uses * (every day) and another targets a specific day-of-week with the same hour:minute, the specific-day entry is a strict subset and should be removed.

Worked examples (this session):

• hypatia/.github/workflows/tests.yml had 0 3 * * * (daily) + 0 3 * * 1 (Monday) — same hour, Monday is a subset. Fix: hypatia#331 dropped the Monday-only cron.
• hypatia/.github/workflows/verify-proofs.yml had 0 5 * * 1, 30 4 * * 1, 0 4 * * 1 — three Monday triggers inherited from pre-consolidation source workflows. Fix: hypatia#331 collapsed to a single 0 4 * * 1.

Remediation guidance to emit:

Collapse to a single cron unless the multiple triggers serve distinct purposes (e.g. different if: gates per trigger). If they're a consolidation artefact, drop the redundant entries.

Implementation pointers

• Detection algorithm: Parse on.schedule[].cron; group by day-of-week (5th position); flag if 2+ entries share a day-of-week (incl. *). Special case: subset detection when * overlaps a specific day-of-week at the same hour:minute.
• Real-world example: hypatia/.github/workflows/tests.yml (0 3 * * * + 0 3 * * 1 — Monday is a subset); hypatia/.github/workflows/verify-proofs.yml (three Monday crons inherited from consolidation).
• Landed fix (reference): hypatia#331 (dropped Monday-only cron in tests.yml; collapsed three Monday triggers to one in verify-proofs.yml).
• Rule statement: Collapse to a single cron unless the multiple triggers serve distinct purposes (e.g. different if: gates per trigger). If they're a consolidation artefact, drop the redundant entries.

Acceptance

• Rule encoded in hypatia (file path follows existing rule naming convention — lib/rules/<name>.ex if Elixir, or matching the repo's rule DSL)
• Test fixture exercising the positive case + at least one negative case
• Smoke test passes against the cited landed-fix repo

Source cohort: hypatia#333.

[hyperpolymath]

cicd triage 2026-05-30 — scoped plan + park

PR #403 ships the first batch of 4 rules from this cohort (#336, #337, #338, #390). This issue is in the next batch; landing it requires more substantial work than the first four:

Detection on on.schedule[].cron strings, group by day-of-week (5th field), flag duplicates. Subset special case for * overlap. Single-file YAML parse — add to lib/rules/workflow_audit.ex as WF022.

The issue body is the implementation spec (detection algorithm + worked example + remediation guidance — well-formed). Next-batch PR will pick this up. Leaving open with cicd label.