Inventory live actors that trigger portfolio workflows #204

🤖 Generated by the Agentic Engineer

Evidence

PR #203 inventories every active repository's workflow paths, trigger events, exposure class, and
repository-policy count. It does not yet identify who has actually started those workflows. GitHub's
workflow execution policy API requires each allowed actor as a numeric id plus an actor type, and
GitHub's documentation warns that a workflow triggered by an identity such as dependabot[bot]
needs that identity in the allowlist even when GitHub's built-in process is exempt.

The parent inventory currently finds 142 workflows across 23 active repositories, including 85
manual or cross-repository entry points. Designing actor rules from account names or provider labels
would risk either stranding required automation or admitting the wrong principal.

Objective

Add a read-only actor-evidence inventory that joins active workflow paths to their observed trigger
actors and events, resolving each observed login to the live GitHub actor ID and type.

This is evidence for the parent policy design, not an allowlist and not policy enforcement. A missing
observation must stay visibly unknown; it must never be treated as proof that no actor is required.

Acceptance criteria

• For every active repository workflow, enumerate the actors and events observed in a bounded,
  documented run-history window, including both the original and re-running actor when GitHub
  reports them separately.
• Resolve every observed login to its live numeric actor ID and GitHub actor type; fail closed on
  an unreadable actor or an ID/type mismatch between run history and the live actor record.
• Report a workflow with no run in the window as NO-RUNS, distinct from UNKNOWN evidence.
• A partial repository, workflow, run-history, or actor read exits 2 and emits UNKNOWN; partial
  output is never described as a complete inventory.
• Offline tests prove actor deduplication, rerun attribution, no-run handling, and the fail-closed
  paths before the live implementation is added.
• Wire the offline test into the required CI job and document the new command in AGENTS.md.

Out of scope

• Selecting the approved actor set.
• Creating or enforcing an Actions policy.
• Treating observed actors as a complete allowlist; reusable-workflow callers and never-run paths
  still need their own declared-intent join under Adopt workflow execution protections across the portfolio #202.

Small-to-medium. Part of #202.