OSAC-4808: Add Ship/Show/Ask risk classification labels

[ItzikEzra-rh]

Summary

• Add auto_apply_labels with three mutually exclusive risk labels (risk:ship, risk:show, risk:ask) ported from flightctl
• Add high_level_summary_instructions with risk classification justification (flightctl ref)
• Generic criteria that work across all osac-project repos (not mono-repo-specific)
• Labels-only — data-collection phase to validate classifications match team intuition before enabling merge-path changes

What changed

Added 115 lines to .coderabbit.yaml:

• high_level_summary_instructions — requests a "Risk classification" section in every PR summary with justification
• auto_apply_labels: true — enables automatic label application
• labeling_instructions — detailed criteria for each risk level
• mutually_exclusive_groups — ensures only one risk label per PR

Jira

https://redhat.atlassian.net/browse/OSAC-4808

Test plan

• YAML syntax validated locally
• Comment @coderabbitai configuration on this PR to validate schema
• After merge, verify labels appear on a subsequent PR in any osac-project repo

Summary by CodeRabbit

• Documentation

  • Added guidance requiring change summaries to identify affected areas and backward-compatibility considerations.
  • Added a final risk classification section to generated summaries.

• Workflow

  • Added automatic, mutually exclusive risk labels for changes that are ready to ship, require review, or need clarification.

[coderabbitai]

Warning

This pull request changes a CodeRabbit configuration file. Because it comes from a fork or its author is not a repository collaborator, reviews use only the configuration from the target branch. The proposed configuration will take effect after it is merged.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: e94f8d6e-03c6-4211-8f05-3a6b9af5c8f2

📥 Commits

Reviewing files that changed from the base of the PR and between dda6e7b and b584182.

📒 Files selected for processing (1)

• .coderabbit.yaml

Included review availability: Your plan provides up to 12 included reviews per hour; 11 remain after this review.

---

Walkthrough

The CodeRabbit configuration now requires affected-area and compatibility details in summaries. It also defines mutually exclusive risk:ship, risk:show, and risk:ask label rules.

Changes

CodeRabbit policy configuration

Layer / File(s)	Summary
Summary requirements .coderabbit.yaml	High-level summaries must identify affected areas, backward-compatibility implications, and the applied risk classification.
Risk classification labels .coderabbit.yaml	The configuration defines criteria for risk:ship, risk:show, and risk:ask, then makes the labels mutually exclusive.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to b5841

This PR adds risk-label classification configuration without a demonstrated correctness, security, availability, or deployment issue; no actionable merge-blocking risk remains beyond normal checks and review.

Suggested reviewers: sk-ilya

🚥 Pre-merge checks | ✅ 11

✅ Passed checks (11 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: adding Ship/Show/Ask risk classification labels.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
No-Hardcoded-Secrets	✅ Passed	PASS: The pull request adds only prose, risk labels, and YAML configuration. The parent-to-HEAD diff contains no API key, token, password, private-key material, credential-bearing URL, encoded blob ov…
No-Weak-Crypto	✅ Passed	PASS: The pull request changes only .coderabbit.yaml by adding summary and risk-label configuration. The diff adds no MD5, SHA1, DES, RC4, 3DES, Blowfish, ECB, custom cryptography, or secret compari…
No-Injection-Vectors	✅ Passed	PASS: The pull request changes only .coderabbit.yaml. The exact parent-to-HEAD diff adds declarative labels and review instructions. It introduces no SQL concatenation, shell=True with user input,…
Container-Privileges	✅ Passed	PASS. The pull request changes only .coderabbit.yaml; it adds CodeRabbit summary and risk-label instructions. It does not add or modify a container or Kubernetes manifest. The privilege terms found …
No-Sensitive-Data-In-Logs	✅ Passed	PASS: The PR changes only .coderabbit.yaml by adding CodeRabbit summary and risk-label instructions. The parent-to-PR diff contains no logging implementation, log statements, or data handling. The a…
Ai-Attribution	✅ Passed	AI use is present in the PR context and commit. The changed commit includes Assisted-by: Claude Code <noreply@anthropic.com> and does not include a Co-Authored-By trailer. The attribution requirem…

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

Full details: No-Hardcoded-Secrets

Explanation

PASS: The pull request adds only prose, risk labels, and YAML configuration. The parent-to-HEAD diff contains no API key, token, password, private-key material, credential-bearing URL, encoded blob over 32 characters, or secret-named variable assigned a literal. The words “secrets” and “credentials” occur only in classification instructions.

Full details: No-Weak-Crypto

Explanation

PASS: The pull request changes only .coderabbit.yaml by adding summary and risk-label configuration. The diff adds no MD5, SHA1, DES, RC4, 3DES, Blowfish, ECB, custom cryptography, or secret comparison implementation. The existing no-weak-crypto instruction text is unchanged context, not introduced usage.

Full details: No-Injection-Vectors

Explanation

PASS: The pull request changes only .coderabbit.yaml. The exact parent-to-HEAD diff adds declarative labels and review instructions. It introduces no SQL concatenation, shell=True with user input, eval/exec, pickle.loads, yaml.load calls, os.system, or dangerouslySetInnerHTML with user data. Existing security-review text is configuration prose, not executable code, and is not introduced by this pull request.

Full details: Container-Privileges

Explanation

PASS. The pull request changes only .coderabbit.yaml; it adds CodeRabbit summary and risk-label instructions. It does not add or modify a container or Kubernetes manifest. The privilege terms found in the file are review-instruction prose, including pre-existing container-privileges instructions and unchanged Kubernetes guidance. No changed manifest contains privileged: true, host namespace settings, SYS_ADMIN, root execution, or allowPrivilegeEscalation: true.

Full details: No-Sensitive-Data-In-Logs

Explanation

PASS: The PR changes only .coderabbit.yaml by adding CodeRabbit summary and risk-label instructions. The parent-to-PR diff contains no logging implementation, log statements, or data handling. The added text only mentions “logging improvements” as an example and does not expose passwords, tokens, API keys, PII, session IDs, hostnames, or customer data.

Full details: Ai-Attribution

Explanation

AI use is present in the PR context and commit. The changed commit includes Assisted-by: Claude Code <noreply@anthropic.com> and does not include a Co-Authored-By trailer. The attribution requirement is satisfied.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[eranco74]

/lgtm