It's executed three times, once for each matching file. There's a hint in the man page:
sharedscripts
Normally, prerotate and postrotate scripts are run for each log which is rotated and the absolute path
to the log file is passed as first argument to the script. That means a single script may be run multi-
ple times for log file entries which match multiple files (such as the /var/log/news/* example). If
sharedscripts is specified, the scripts are only run once, no matter how many logs match the wildcarded
pattern, and whole pattern is passed to them. However, if none of the logs in the pattern require
rotating, the scripts will not be run at all. If the scripts exit with error, the remaining actions will
not be executed for any logs. This option overrides the nosharedscripts option and implies create
option.
But of course, you only find that once you know to look there. (Also, I experimentally verified with logrotate -v ;) )