NO-ISSUE: Add Ship/Show/Ask assessments to CodeRabbit - #805

Walkthrough

The CodeRabbit configuration now requires risk classification in high-level summaries. It applies mutually exclusive risk:ship, risk:show, and risk:ask labels using rules for change type, security, dependencies, infrastructure, CI, configuration, generated files, and policy changes.

Changes

Risk classification workflow

Priority: ⬇️ Low — Defer this CodeRabbit configuration change because it only adds informational risk labels and summary guidance without changing merge automation or product behavior.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Other

Merge Risk: 🔵 Low · up to 16503

This change adds automatic risk classification labels, but the required GitHub labels must be created first or classifications may not appear on pull requests. Create the labels before merging.

Suggested reviewers: celdrake

_{Comment @coderabbitai help to get the list of available commands.}

@coderabbitai Addressed the outside-diff security classification finding: risk:ask now explicitly includes security-sensitive code, trust boundaries, and security controls anywhere in the frontend or proxy. The existing authentication, authorization/RBAC, organization isolation, secrets, credentials, certificates, and security-sensitive configuration triggers are preserved. This trigger takes precedence over both Ship and Show.

Validation: npm run lint, CodeRabbit schema validation, and git diff --check passed. A parsed-YAML comparison confirmed that only the intended Ask criterion changed.

@adalton Confirmed. The updated risk:ask criterion covers security-sensitive changes outside the diff scope in both the frontend and proxy. Its precedence over risk:ship and risk:show prevents a lower-risk label from classifying these changes.

📝 Learnings were identified and not saved (knowledge base disabled). Enable

You are interacting with an AI system.

#!/bin/bash
set -euo pipefail

echo '=== Current PR diff and head ==='
git rev-parse HEAD
git diff --check HEAD^ HEAD || true
git diff --unified=3 HEAD^ HEAD -- .coderabbit.yaml

echo '=== CodeRabbit configuration outline and relevant label/risk criteria ==='
ast-grep outline .coderabbit.yaml --items all 2>/dev/null || true
rg -n -i -C 4 '(risk:|area label|area-label|auto.*label|label.*auto|security-sensitive|outside.diff|outside diff)' .coderabbit.yaml

echo '=== GitHub workflow files and PR-label references ==='
fd -t f -e yml -e yaml .github 2>/dev/null || true
rg -n -i -C 3 '(pull_request_target|pull_request|issues|label|labeled|unlabeled|pull-requests)' .github/workflows 2>/dev/null || true

echo '=== PR description, reviews, review comments, and issue comments ==='
gh pr view 805 --repo flightctl/flightctl-ui --json url,headRefOid,body,labels
gh api 'repos/flightctl/flightctl-ui/pulls/805/reviews?per_page=100' \
  --jq '.[] | {id, user: .user.login, commit_id, state, body}'
gh api 'repos/flightctl/flightctl-ui/pulls/805/comments?per_page=100' \
  --jq '.[] | {id, user: .user.login, commit_id, path, line, original_line, body}'
gh api 'repos/flightctl/flightctl-ui/issues/805/comments?per_page=100' \
  --jq '.[] | {id, user: .user.login, body}'

@adalton Confirmed.

The current PR head includes the requested risk:ask security trigger. It covers security-sensitive code, trust boundaries, and security controls in the frontend and proxy. The trigger takes precedence over risk:ship and risk:show.

The configuration and PR description now explicitly state that auto_apply_labels: true applies both risk labels and area labels. This behavior is intentional. The labels remain informational. The PR does not change merge automation or merge requirements.

The workflow inspection found no PR-label event, condition, or trigger. The labels entries in push-to-main.yaml are container-image metadata labels. They are not PR labels.

The prior finding about automatic area-label application does not apply to this PR scope. I am withdrawing it.

📝 Learnings were identified and not saved (knowledge base disabled). Enable

You are interacting with an AI system.

I've been lately adding a custom "size" label to give reviewers some rough idea of the scope of the changes.

Is this something that could also be automated? Does it exist in any other project?

AFAIK, we don't have this on other repos. It is something that I think would be possible to do as a follow-up. We'd just need to identify the criteria you want to use to decided on what size means.

Currently Coderabbit includes something like this. Perhaps this could be used as a starting point, and adjust as we see necessary. My criteria was based on a mixture of number of files changed, and complexity of the changes, but it wasn't objective enough.

Example:

Estimated code review effort: 3 (Moderate) | ~20 minutes