Skip to main content
Gitar classifies each PR as Low, Medium, or High risk to help reviewers decide where to focus attention. The assessment reflects the impact of the whole change, including sensitive behavior that a small diff can affect.

​
What the risk levels mean

Risk describes the change’s potential impact. It is separate from the severity of an individual finding and the overall review verdict. A PR can have no reported defects and still be high risk. For example, a correct change to payment calculations may need closer human review because of the behavior it affects.

​
Where risk appears

The risk label appears inside the expanded Code Review section of the PR dashboard comment. It also appears in expanded activity details in the Gitar dashboard. Gitar hides the previous label while a review is processing. Older reviews without an assessment gain one when another review runs.

​
How Gitar assesses risk

Gitar uses the whole PR diff and file-change information, so a small follow-up push does not hide the risk of earlier changes in the same PR.
1

Assess the whole change

Gitar applies the default definitions and the organization’s risk instructions to the PR.
2

Apply repository guidance

Repository instructions can raise the risk level to reflect local constraints. They cannot lower the organization’s assessment.
3

Refresh before automated decisions

When the change needs reassessment, including after a Gitar fix, Gitar refreshes risk before evaluating approval or merge criteria.
Uncertain impact normally produces Medium risk. If Gitar cannot complete the assessment, it uses High risk so a failed assessment cannot satisfy a low-risk approval condition.

​
Define risk for the organization

Organization admins set policy under Settings -> Configuration -> Custom Instructions. Risk classification turns assessment on or off, and Risk instructions refines what each level means for the team. Risk classification is on by default. Leaving the instructions empty uses Gitar’s default definitions. For example:
Turning classification off hides risk labels and retains saved instructions. Risk-dependent approval or merge criteria require an assessment unless those criteria explicitly allow unavailable risk.

​
Add repository guidance

The file .gitar/config/risk.md adds risk instructions for one repository.
Gitar considers both the default-branch policy and additions in the PR. Deleting or emptying the PR’s copy does not remove the default-branch policy from that review. Policy changes apply when a review runs. Saving instructions does not reclassify every historical PR.

​
Use risk in approval and merge criteria

Risk can restrict existing automation after code review. Low risk alone does not approve or merge a PR. Blocking findings and platform checks still apply. The same assessment feeds these decisions, so the approval step does not invent a different risk level from a clean verdict.

Code Review

Findings, verdicts, and review coverage.

Functional Validation

Track whether the change implements the linked issue’s requirements.