docs: document peer-advisory-drift in the org README

[msalvatti]

peer-advisory-drift.yml merged in #17 without any of the four places that describe the shared CI being updated. Three were incomplete. One was wrong.

The one that was wrong

The cost philosophy stated, categorically:

🤖 The only scheduled work is third-party dependency/security, handled by Dependabot on GitHub infrastructure (≈ zero Action minutes) — not a cron CI job.

That is no longer true — the workflow I merged is a cron CI job. Quietly deleting the sentence would have hidden that a stated org principle now has an exception, so it says what the exception is and why it has to exist:

Dependabot audits what is installed — the lockfile — and stays quiet while a published peerDependencies range still admits a version with an advisory. The range never changes and becomes wrong anyway, because the advisory database is what moves. The drift arrives with no commit and no alert, between releases, when nothing is being pushed. That is why it cannot be event-driven.

The cost caveat is preserved: read-only GraphQL queries, no build, no install.

The three that were incomplete

Section	What was missing
📂 What lives here	the workflow was absent from the inventory of reusables
Inputs reference	node-ci, node-lib-ci and rust-ci each document their inputs; this one had none
🧭 Project types	Node libraries list which reusables they call

The inputs section follows the existing shape — inputs table, defaults, notes — plus an outputs table, since this is the first reusable with outputs worth consuming. The caller snippet is copied from the one now running in nest-queue, with the two non-obvious decisions explained inline: why the concurrency group is deliberately not keyed by github.ref, and why the job is pinned to the default branch.

Rust is recorded as a gap, not an exclusion

Example apps are not published, so nothing reads the ranges they declare — genuinely out of scope. Rust is different, and saying so is more useful than silence: the advisory database exposes the same data under ecosystem: RUST, but auditing it means parsing Cargo.toml and [workspace.dependencies] and honouring Cargo's semantics, where a bare "1.2" already means ^1.2. cargo-audit covers the installed side there — the same blind spot this workflow exists to close on the Node side.

Verification

Not eyeballed. Parsed the workflow and cross-checked every documented field against it:

INPUTS   ✅ manifest-path · dependency-types · severity-threshold · issue-label · fail-on-drift
         (every default matches the workflow)
OUTPUTS  ✅ drift-count · advisory-count
         no input documented that does not exist

The caller snippet was diffed field-by-field against the live one in nest-queue — name, cron, concurrency group, cancel-in-progress, issues: write, the default-branch guard — all match. Every internal link in the README resolves.

⚠️ Still pending after this

The v1 tag has not been moved. It points at ed0df64 while main is ahead, so peer-advisory-drift.yml returns 404 at @v1 and the callers already merged into nest-queue cannot resolve it. The README's own runbook covers it:

git checkout main && git pull && git tag -f v1 && git push -f origin v1

Say the word and I will move it.

---

Ready for your review — not merging it.

[Copilot]

Pull request overview

Updates the org-level README to document the peer-advisory-drift reusable workflow, including why it exists as the sole cron-based CI exception and how repos should call it.

Changes:

• Adds peer-advisory-drift.yml to the “What lives here” inventory and “Project types” matrix.
• Updates the “Cost philosophy” section to explicitly describe the single scheduled CI exception and its rationale.
• Adds a dedicated inputs/outputs reference section for the peer-advisory-drift reusable, including a caller snippet and required permissions.

[msalvatti]

{
  "pr": 18,
  "repo": "bymaxone/.github",
  "localGate": "none — docs-only change in a repo with no package.json; CI is the gate",
  "consecutiveFailures": {},
  "flakyReruns": {},
  "processedCommentIds": [3695724378],
  "processedFindings": [
    "2026-08-01T13:45:24Z README:102 — 'runs no install' overstated; the job installs semver into RUNNER_TEMP, just never the caller's tree. Fixed in 1e136e9."
  ],
  "paused": false,
  "note": "Copilot delivers findings in the review BODY as suppressed comments, not only as threads. A thread count of 0 does NOT mean no outstanding findings — always read the newest review body."
}

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

Suppressed comments (1)

README.md:255

• The Project types table marks peer-advisory-drift.yml as “✅ Live (@v1)”, but the v1 tag currently points to ed0df64 and does not include .github/workflows/peer-advisory-drift.yml (it 404s at @v1). Until v1 is moved, callers pinned to @v1 will fail, so the README should either note this is pending or avoid claiming it’s live at @v1 yet.

| 🟢 **Node libraries** — `@bymax-one/nest-*` | `node-lib-ci.yml` · `security.yml` · `peer-advisory-drift.yml` | ✅ Live (`@v1`) |