[gabe-bots]

Intent

The risk workflow adds a risk:t label on each pull request. Delete the label step. The workflow posts the risk tier check. Labels stay as they are.

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[A pull request updates] --> B{"Run the base copy?"}
  B -->|yes| C[Classify the change]
  C --> D[Post the risk tier check]
  D --> E[Leave labels unchanged]
  B -->|no| F[Run the classifier tests]

Loading

Risk

R0 (R0: review all of it; R1: review the items below; R2: no review needed): The diff edits .github/workflows/risk.yml, an R0 file whose job runs on pull_request_target with write tokens.

ℹ️ 2 items need you: 1 critical, 1 validation gap. Open to see them.

Needs you

#	Needs you	Why	Where
1	Critical: risk workflow on pull_request_target with write tokens	Label step deleted while the check run and write permission stay	.github/workflows/risk.yml:116

Validation gaps

Validation gap	Why the checks miss it	Fix for next time	Where
Live run no longer writes or clears labels	Actions runs the base copy, so this pull request still gets a label	Run these steps in a local runner with a fake GitHub API	.github/workflows/risk.yml:116

Drift

Drift is a difference from the request. None.

Decisions

The request settles every choice. It keeps the permissions, the classifier outputs, and the check run.

Door: two-way. A revert restores the label step.

Evidence

The tier job runs on pull_request_target. GitHub runs the workflow from the base branch. A pull request of this branch still receives a risk:t label from that copy. Existing risk:t labels stay.

Job permissions stay read for contents and issues, and write for pull requests and checks.

Claim	Proof	Result
Run the base copy? → yes: the parsed job has no label step and keeps the check	actionlint 1.7.12 and the YAML step-name parse	✅ 1/1
Run the base copy? → no: the classifier tests pass	python3 -m pytest -q .github/scripts	✅ 149 passed, 1 skipped

What	Before	After
Tier job steps	<code>Classify, Label, Check run "risk tier"</code>	<code>Classify, Check run "risk tier"</code>
risk: matches	header, permission comment, notice, label loop	notice line only

$ /tmp/actionlint /tmp/actionlint-main/risk.yml
main_exit=0
$ /tmp/actionlint .github/workflows/risk.yml
branch_exit=0

$ python3 -c 'import yaml; d=yaml.safe_load(open("/tmp/risk-main.yml")); print([s.get("name") or ("uses:"+s["uses"].split("@")[0]) for s in d["jobs"]["tier"]["steps"]])'
['uses:actions/checkout', 'uses:astral-sh/setup-uv', 'Fetch the PR head as data', 'Read the Greptile review', 'Classify', 'Label', 'Check run "risk tier"']
$ python3 -c 'import yaml; d=yaml.safe_load(open(".github/workflows/risk.yml")); print([s.get("name") or ("uses:"+s["uses"].split("@")[0]) for s in d["jobs"]["tier"]["steps"]])'
['uses:actions/checkout', 'uses:astral-sh/setup-uv', 'Fetch the PR head as data', 'Read the Greptile review', 'Classify', 'Check run "risk tier"']

$ grep -n 'risk:' /tmp/risk-main.yml
3:# and as a risk:* label, and never merges, approves or fails a PR.
56:      pull-requests: write # read review comments; write the risk:* label
113:          if [ "$AUTOMERGE" = "off" ]; then echo "::notice title=risk::AUTOMERGE=off: every PR is T2-hard."; fi
124:          for old in $(gh api "repos/$REPO/issues/$PR/labels" --jq '.[].name | select(startswith("risk:"))'); do
$ grep -n 'risk:' .github/workflows/risk.yml
113:          if [ "$AUTOMERGE" = "off" ]; then echo "::notice title=risk::AUTOMERGE=off: every PR is T2-hard."; fi

$ python3 -m pytest -q .github/scripts
.....................................................................s.. [ 48%]
........................................................................ [ 96%]
......                                                                   [100%]
149 passed, 1 skipped in 0.52s

Reading map

A signal is a change kind that reaches code outside this diff.

Config

.github/workflows/risk.yml lines 2–3, line 56, and line 116.