Give risk assessment confidence its own tier enum

Wanderson Policarporequested to merge
627426-risk-assessment-review-follow-ups into master

What does this MR do and why?

This is a follow-up to the review notes on !252780 (merged), tracked in #627426 (closed).

This MR handles only the first suggestion, from !252780 (comment 3776674877): the confidenceTier field reused the risk tier enum, so the API described a confidence of 75 or higher as CRITICAL, "Critical risk." High confidence is good news, not a risk. This MR gives confidence its own enum, MergeRequestRiskConfidenceTier (LOW, MEDIUM, HIGH, VERY_HIGH). The MR widget now reads VERY_HIGH directly, instead of relabelling CRITICAL.

References

Screenshots or screen recordings

Before After
Screenshot_2026-09-23_at_15.10.44 Screenshot_2026-09-23_at_15.11.47

How to set up and validate locally

  1. Enable both show_duo_mr_risk_classification_widget and duo_mr_risk_classification feature flags

  2. Enable the risk_classification/v1 flow for a project

  3. Open a merge request in that project and wait for the risk classification to finish. The risk assessment widget shows a result.

  4. The widget should have no visual difference

  5. Open GraphQL Explorer (http://gdk.test:3000/-/graphql-explorer) and run this query, using the IID of the merge request from step 1:

    query {
  project(fullPath: "gitlab-duo/test") {
    mergeRequest(iid: "<iid>") {
      riskAssessment {
        confidence
        confidenceTier
      }
    }
  }
}

    Expect confidenceTier to be one of LOW, MEDIUM, HIGH, or VERY_HIGH.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Edited by Wanderson Policarpo

Merge request reports