Classify every portfolio workflow by exposure before designing execution policies #206

🤖 Generated by the Agentic Engineer

Evidence

The read-only inventory in #202 (2026-09-19/20) covers 142 default-branch workflows across 23 active repositories. 85 can be started by hand or from another repository, and 42 look like publish, release or deploy workflows by name only — 26 of those can also be started by hand. Nothing records which workflows actually deploy or publish, so the policy design in #202 has nothing reliable to target.

Audience and problem

Whoever designs the execution policies. A name-based guess is not a safe input for workflow-path targeting: a missed deploy workflow stays open to any actor, and a wrongly classed CI workflow gets locked down and strands required checks.

Expected behaviour

Every workflow has one recorded exposure class — ordinary CI, required reusable workflow, scheduled maintenance, manual/repository dispatch, publication, deployment, or privileged administration — derived from what the workflow does, not from its name.

Acceptance criteria

• The inventory emits an exposure class per workflow path, based on its triggers and on concrete signals in the workflow (secrets it reads, permissions: write scopes, environments, registry pushes, release creation, cluster or cloud credentials).
• Every workflow classed publication or deployment by name alone is confirmed or corrected by reading it.
• Unclassifiable workflows are reported as UNKNOWN, never defaulted to ordinary CI.
• The classified table is recorded on Adopt workflow execution protections across the portfolio #202 as the input to its policy design.

Size: M. Read-only; no policy is applied.