Every pull request in a connected repository can get a risk tier, low,
medium or high, mirrored to a risk:low, risk:medium or risk:high
label on GitHub. Reviewers see at a glance which PRs need careful eyes.
Risk labels are in early access: ask us to turn on risk_labels for your
workspace.
How the tier is decided
- It starts at the proposed tier. With no proposal it starts at
medium. - Every path rule that matches a changed file raises it to that rule’s tier. Rules never lower a tier. A rename matches on both its old and new path.
- A person can override the result. The computed tier is kept alongside it.
A diff too large for GitHub to list in full (over 3,000 files) is high.
The built-in rules raise PRs that touch:
| Paths | Tier | Why |
|---|---|---|
migrations/, migration/, migrate/, alembic/, flyway/ and liquibase/ folders, *.sql, schema.prisma, schema.rb |
high | Schema or data migration |
auth/, authz/, permissions/, rbac/, oauth/, sso/ and security/ folders (and similar), code files named after auth, permissions, passwords, tokens, secrets or crypto |
high | Authentication or authorization |
billing/, payments/, checkout/, invoices/ and subscriptions/ folders |
high | Billing |
.github/workflows/, .gitlab-ci.yml, .circleci/, .buildkite/, Jenkinsfile, Azure and Bitbucket pipelines |
high | CI pipeline |
Dockerfile, Compose files, Procfile, fly.toml, vercel.json, netlify.toml, render.yaml, app.yaml |
high | Build and deploy config |
*.tf, *.tfvars, *.hcl, and terraform/, infra/, k8s/, helm/, charts/, pulumi/ and cdk/ folders |
high | Infrastructure as code |
CODEOWNERS |
high | Review and ownership rules |
| Dependency manifests and lockfiles (npm, Yarn, pnpm, Bun, pip, Poetry, uv, Go, Cargo, Bundler, Composer, Maven, Gradle, NuGet, Mix) | medium | Dependency change |
Settings → Risk labels shows the exact globs. Add the paths that matter in your own codebase as workspace rules.
Add your own rules
Go to Settings → Risk labels in the app. Workspace owners and admins can:
- add path rules, each with a glob, a tier (
mediumorhigh) and a reason shown with the assessment, - turn the built-in rules off.
Rules apply to every repository in the workspace and only ever raise a tier.
Check every PR automatically
Turn on GitHub checks under Settings → Risk labels to classify every pull request in your connected repositories, including PRs your team opens without Trevize. No CI setup is needed. Each time a PR is opened, reopened or pushed to, Trevize:
- classifies it with your workspace rules,
- adds or updates a Trevize risk check on the latest commit, with the tier and the rules that raised it,
- updates its
risk:*label.
The check is informational: it always completes as neutral, so it never blocks a merge. Workspace owners and admins can turn checks on once GitHub is connected.
The Trevize GitHub App needs the Checks permission to add the check. If a repository’s installation has not approved it yet, the PR still gets its label, and the CLI reports that the check was not updated.
Classify a PR
From a laptop, a local agent session or CI:
trevize risk classify https://github.com/acme/app/pull/123
trevize risk classify # the open PR for the current branch
trevize risk classify --propose low --rationale "Copy change in the footer only"The server fetches the PR’s changed files and your workspace’s rules, stores
the tier and applies the label. --no-label stores without labeling and
--dry-run only prints. Exit code 3 means the repository is not connected to
your workspace.
Every trevize risk command needs a login (trevize login) or an API key.
To classify PRs from your own CI instead of turning on GitHub checks, add a
step with a TREVIZE_API_KEY secret. The CLI runs on Node, so it works on
GitHub-hosted runners without installing Bun:
- run: npx -y trevize risk classify "${{ github.event.pull_request.html_url }}"
env:
TREVIZE_API_KEY: ${{ secrets.TREVIZE_API_KEY }}
TREVIZE_WORKSPACE_ID: ${{ vars.TREVIZE_WORKSPACE_ID }}Local agents can use the classify_risk and get_risk tools of
trevize mcp. An agent may propose a tier but never override one.
After the first classification, every push to the PR re-classifies it.
Override
Add a risk label on GitHub, or run:
trevize risk set https://github.com/acme/app/pull/123 --tier high --reason "Touches the export job"
trevize risk set https://github.com/acme/app/pull/123 --clearA person adding a label overrides the tier with their GitHub login; if several are added at once, the highest wins. Removing the only risk label goes back to the computed tier. For a PR opened by a Trevize task, the override applies to every PR of that task.