[vitormattos]

Summary

• Allow the reusable governance action to target an entire organization (organization) while preserving the existing repository input.
• Add opt-in allow-drift to report planned differences without treating them as an execution failure. The default drift exit code remains unchanged.
• Keep --apply as the only operation that writes rulesets or repository metadata.
• Reject action calls specifying both an organization and a repository.

Motivation

The organization callers currently fan out one environment-protected job per repository (over 100 for LibreCodeCoop). Each job needs environment approval. Once approved, dry runs report expected DRIFT with exit code 1 and GitHub marks the whole workflow as failed.

Organization-scoped mode lets each caller run one protected job per execution. allow-drift keeps plan logs readable without suppressing actual API or configuration errors.

Validation

• npm run check (typecheck, 47 Vitest tests, build): passed locally.
• New tests cover opt-in drift tolerance for organization/repository, preserving the default drift failure, and propagation of API errors.
• Callers must request administration read for plan and write only for a manually authorized apply. Credentials stay in the protected ruleset-sync environment.

Rollout

Merge and release/pin this reusable action first, then update caller workflows in LibreCodeCoop/.github and LibreSign/.github. Do not auto-apply governance while deploying this change.