fix(peer-advisory-drift): stop setup-node from caching a manager it has no use for

[msalvatti]

The v1 tag was moved, and the first real run of this workflow failed — caught before Monday's schedule, on a manual dispatch in nest-queue.

##[error] Unable to locate executable file: pnpm

Cause, from the action's own definition rather than a guess

actions/setup-node@v5 declares:

package-manager-cache:
  description: 'Set to false to disable automatic caching based on the package
                manager field in package.json. By default, caching is enabled
                if the package manager field is present.'
  default: true

So it enables package-manager caching on its own whenever the checked-out package.json carries a packageManager field, then shells out to that manager to locate its store. This job checks out the caller's repository to read its manifest — and never installs the caller's toolchain, because it reads a manifest rather than building a tree. pnpm is simply not there.

Scope: this was not one repository

Every Bymax package declares the field:

nest-queue pnpm@11.0.0 · nest-cache pnpm@10.8.1 · nest-logger pnpm@10.8.1
nest-notification pnpm@10.8.1 · nest-auth pnpm@10.8.1 · nest-ai-tokens pnpm@10.8.1
nest-config pnpm@10.8.1 · nest-core pnpm@10.8.1 · nest-realtime pnpm@11.0.0
nest-storage pnpm@10.8.1

Ten for ten. The first scheduled run would have failed in every repo that adopts this, and a workflow that fails on its first outing is one people stop reading.

The fix

package-manager-cache: false. There is nothing to cache — turning the cache off is the honest fix, rather than installing pnpm so an unused cache can succeed. The reason is recorded inline, including the error string, so the next person to touch this step does not re-enable it.

What the failed run did prove

Worth separating, because most of the wiring was correct:

• the reusable resolved at @refs/tags/v1 (2eb029f) — the tag move works
• all five inputs arrived with their defaults
• the token carried Contents: read and Issues: write — the permission chain through the caller is right
• actions/checkout succeeded

It failed at the next step, which is exactly the kind of defect a dry run exists to find.

⚠️ v1 has to move again

v1 currently points at 2eb029f, which contains the broken step. After this merges the tag needs advancing again, and I will re-run the manual dispatch on nest-queue to confirm a green end-to-end run before Monday.

---

Ready for your review — not merging it.

[Copilot]

Pull request overview

Disables actions/setup-node@v5’s implicit “package manager” caching in the peer-advisory-drift reusable workflow to prevent failures when the caller repo declares packageManager (e.g., pnpm@...) but the workflow intentionally does not install that toolchain.

Changes:

• Turn off setup-node’s automatic package-manager cache via package-manager-cache: false.
• Add an inline rationale documenting the observed failure (Unable to locate executable file: pnpm) and why installing pnpm would be unnecessary in this job.