Risk Assessment

Code Review Risk Assessment adds a risk signal to Unblocked’s automated pull request reviews. You define the kinds of changes your team considers risky, and Unblocked scores each PR against those policies. Teams can use that score to approve routine changes faster while keeping human reviewers focused on work that needs closer judgment.

How it works

Every time Unblocked runs a code review on a pull request, it also runs a risk assessment. Unblocked reads the risk policy file that you define from your repository and checks the PR changes against each policy. It then adds a report with a risk score — lowest, low, medium, high, or highest — and an explanation for the score. With Auto-approve low risk Pull Requests enabled in Code Review settings, Unblocked approves the pull request if the risk score is low or lowest and the code review finds no issues. Otherwise, Unblocked just posts the report so reviewers can see what needs attention. When Unblocked re-reviews a PR, it reruns the risk assessment on the entire PR and updates the existing risk assessment comment with the new result. Unblocked uses the policy from the default branch, not policy changes proposed by PRs. This keeps the risk score tied to the rules your team has already accepted.

Risk labels

On GitHub and GitHub Enterprise, Unblocked also adds a label to each PR that reflects its current risk score: risk: lowest, risk: low, risk: medium, risk: high, or risk: highest. Labeling is best effort — the matching label must already exist in the repository for Unblocked to apply it.

Setup

Risk assessment is enabled per repository. To turn it on for a repository, add a policy file that describes which kinds of changes your team considers risky. You can write the file manually following the examples below, or ask Unblocked to create a first draft that you review and tune before committing.

Create a risk policy file

Create .unblocked/risk-policies.yaml in the root of your Git repository. You can also ask Unblocked to draft an initial version.

Create a risk assessment policy for the backend repo

Review and tune the policy file

Review the policy file and tune it so it matches how your team thinks about risk.

Commit the policy file

Commit and push the file to the default branch.

Sample policies

Start with a small set of policies that cover the changes your team wants to treat with extra care. Write each policy so it can be evaluated on its own, without relying on another policy or an external definition. If you need to add general guidance or background information, add it to the optional context section.

# .unblocked/risk-policies.yaml

context: >
  This repository includes customer authentication and billing code.
  Changes to either area should be reviewed carefully.

policies:
  - policy: Authentication changes
    risk: highest
    criteria: >
      The PR changes sign-in, session management, permissions,
      or authentication tokens.

  - policy: Database changes
    risk: high
    criteria: >
      The PR changes database schema, migrations, ORM models,
      or destructive data operations.

  - policy: Dependency updates
    risk: medium
    criteria: >
      The PR updates runtime dependencies, lockfiles, build plugins,
      or generated clients.

Schema

The policy file is YAML. It can include optional repository context and one or more independent policies. Each policy names a kind of change and the risk Unblocked should assign when it matches.

title: Unblocked Risk Policies
type: object
required:
  - policies
additionalProperties: false
properties:
  context:
    description: >
      Optional repository background for interpreting policies.
      Use this for stable domain context, key systems,
      ownership boundaries, or terminology.
    type: string
    minLength: 2
    maxLength: 4000
  policies:
    description: >
      Risk policies evaluated against a pull request.
      Each policy is evaluated independently. When multiple
      policies match, Unblocked uses the highest risk.
    type: array
    minItems: 1
    items:
      type: object
      required:
        - policy
        - risk
        - criteria
      additionalProperties: false
      properties:
        policy:
          description: >
            Short, human-readable name for this policy.
            Use a name that makes the policy easy for your team to recognize and maintain.
          type: string
          minLength: 2
          maxLength: 80
        risk:
          description: >
            Risk level assigned when this policy matches.
            When multiple policies match, Unblocked uses the
            highest risk.
          type: string
          enum:
            - lowest
            - low
            - medium
            - high
            - highest
        criteria:
          description: >
            Self-contained condition for when this policy applies.
            Describe only the PR changes that should trigger it.
          type: string
          minLength: 2
          maxLength: 4000

Getting Started with Unblocked

Product Guides

Using Unblocked

Personal Settings

Team Settings

Billing

Data Sources

How it works

Risk labels

Setup

Sample policies

Schema

​How it works

​Risk labels

​Setup

​Sample policies

​Schema

How it works

Risk labels

Setup

Sample policies

Schema