OSAC-4808: Add Ship/Show/Ask risk classification labels

.coderabbit.yaml

@@ -13,6 +13,15 @@ reviews:
   profile: "chill"
   request_changes_workflow: true
   high_level_summary: true
+  high_level_summary_instructions: >-
+    Summarize changes in terms of which areas are affected (API surface,
+    controllers, database, auth, deployment, CI, tests, documentation),
+    and flag any backward-compatibility implications. End the summary
+    with a "Risk classification" section that states which risk label
+    (risk:ship, risk:show, or risk:ask) was applied and the specific
+    criteria from the labeling instructions that determined the
+    classification. If the PR was close to a different classification,
+    note which one and why it did not qualify.
   collapse_walkthrough: false
   sequence_diagrams: true
 
@@ -40,6 +49,112 @@ reviews:
       - "main"
       - "release/.*"
 
+  # ── Risk classification (Ship/Show/Ask) ───────────────────────
+  # Informational labels only — no automation. Builds trust in the
+  # classification before any merge-path changes.
+  auto_apply_labels: true
+  labeling_instructions:
+    - label: "risk:ship"
+      instructions: >
+        Apply when the PR makes ONLY trivial, mechanical changes with
+        near-zero risk of runtime impact. ALL changed files must fall
+        into one or more of these categories — if ANY file falls outside,
+        do not apply this label.
+
+        Eligible file categories:
+        - Documentation (*.md, docs/**) excluding review-policy files
+          (AGENTS.md, CLAUDE.md, CONTRIBUTING.md — these govern review
+          behavior and are not trivial)
+        - CI configuration — comment and formatting changes only to
+          existing files under .github/workflows/** and
+          .github/actions/** (any semantic change — including run,
+          uses, on, if, needs, runs-on, concurrency, timeout-minutes,
+          continue-on-error, defaults, environment, artifacts, build
+          inputs, test matrix, secrets, or permissions — is not Ship;
+          new workflow files are not Ship)
+        - Dependency version bumps in lock files (go.sum, go.mod,
+          package-lock.json, yarn.lock, Cargo.lock) with no API surface
+          change (patch or minor only; major version bumps are not Ship)
+        - Generated code regeneration with no hand-edited changes
+          (**/*.gen.go, **/*.pb.go, **/zz_generated.deepcopy.go)
+        - .gitignore, .editorconfig, Makefile comment-only or
+          whitespace-only changes with no effect on targets or recipes,
+          lint config additions or formatting (not rule removals or
+          disablement)
+
+        Never Ship: any change to hand-maintained source code
+        (generated files matching the patterns above are exempt from
+        this exclusion); API definitions (proto files, OpenAPI specs,
+        CRD types); Helm charts or deployment manifests; Containerfiles;
+        database migrations; hack/ or scripts/ directories;
+        .coderabbit.yaml; review-policy files (AGENTS.md, CLAUDE.md,
+        CONTRIBUTING.md).
+
+        When uncertain, do not apply this label.
+
+    - label: "risk:show"
+      instructions: >
+        Apply when the PR is low-to-medium risk — it changes functional
+        code but is well-scoped and unlikely to cause incidents if the
+        AI review is the only review. Apply ONLY if risk:ship does not
+        fit and ALL of the following are true:
+
+        1. The change is additive or isolated — no removal of existing
+           behavior, no cross-cutting refactors.
+        2. The blast radius is contained to one subsystem (e.g., one
+           controller, one service endpoint, one CLI subcommand, one
+           Helm value with a clear default).
+        3. The PR does NOT introduce a new dependency, remove an
+           existing one, or bump a major version.
+        4. The change does NOT touch any of these high-risk areas:
+           - API definitions (proto files, OpenAPI specs, CRD types)
+           - Auth, OAuth, or identity providers
+           - Database schema or migrations
+           - Controller reconciliation loops
+           - Secrets, credentials, or certificate handling anywhere
+           - Containerfiles or deployment manifests
+           - Helm chart values or templates
+           - hack/ or scripts/ directories
+           - .coderabbit.yaml
+           - Review-policy files (AGENTS.md, CLAUDE.md,
+             CONTRIBUTING.md)
+           - Hand-edited generated files
+
+        Typical Show changes: test additions or fixes, CLI help text,
+        logging improvements, Helm chart doc annotations, single-
+        function bug fixes in non-critical paths, new utility functions
+        with tests.
+
+        When uncertain, do not apply this label.
+
+    - label: "risk:ask"
+      instructions: >
+        Apply when the PR does not qualify for risk:ship or risk:show.
+        This is the default — if neither of the other labels fits,
+        apply this one. Also apply when:
+
+        - The change touches API definitions, auth, database, or
+          controller reconciliation logic
+        - The change modifies security-sensitive configuration
+        - The change is a cross-cutting refactor affecting multiple
+          packages or subsystems
+        - The PR introduces a new dependency or removes an existing one
+        - The change modifies Containerfiles or deployment manifests in
+          ways that affect runtime behavior
+        - The change modifies hack/ or scripts/ directories
+        - The change modifies .coderabbit.yaml (review policy)
+        - The change modifies review-policy files (AGENTS.md,
+          CLAUDE.md, CONTRIBUTING.md)
+        - The change hand-edits generated files rather than pure
+          regeneration
+        - You are uncertain about the appropriate risk level
+
+  mutually_exclusive_groups:
+    risk:
+      - "risk:ship"
+      - "risk:show"
+      - "risk:ask"
+
   path_instructions:
 
     # ── Injection & input validation ─────────────────────────────