## Why The merge request risk flow and its widget use the term "Risk Classification". The product name for this feature is now "Risk Assessment". Some parts of the code already use the new term, for example the database table `merge_requests_risk_assessments`, the model `MergeRequests::RiskAssessment`, and the GraphQL types `MergeRequestRiskAssessment*`. This issue tracks the work to rename the rest of the code and the user-visible text, in small merge requests. ## Out of scope - Flow reference `risk_classification/v1`, `FoundationalFlow.risk_classification_v1`, and the `Ai::Catalog::FoundationalFlow::RiskClassification` module. These names must match the flow reference. - Context category `agent_platform_risk_classification_context` and its JSON schema in `app/validators/json_schemas/`. Same reason. - The AI gateway flow config (`duo_workflow_service/agent_platform/v1/flows/configs/risk_classification/1.0.0.yml`), its prompt IDs, response schema, and tool name `submit_merge_request_risk_classification`. These form a cross-repo contract and stay as they are. - Feature flags `duo_mr_risk_classification` and `show_duo_mr_risk_classification_widget`. A rename would reset the rollout. The flags will go away at general availability. - The database column `merge_requests_risk_assessments.classification`. This column holds the flow's claims. A rename needs a migration, with no gain for users. - `CHANGELOG.md` and `locale/*/gitlab.po`. Crowdin owns the `.po` files. ## Plan - [x] MR 1 - Rename translatable strings and API docs text from "classification" to "assessment". - Change the gettext namespace `RiskClassification|` to `RiskAssessment|` in the widget JS files and in the Ruby labels and errors under `ee/lib/gitlab/duo/risk_classification/`. - Update the flow display name and description in `ee/app/models/ai/catalog/foundational_flow/risk_classification/definition.rb`. - Update GraphQL description text in `risk_assessment_type.rb`, `merge_request_type.rb`, and `status_enum.rb`. - Regenerate `gitlab.pot` and the GraphQL docs with their rake tasks; do not hand-edit them. - Merge requests: - https://gitlab.com/gitlab-org/gitlab/-/merge_requests/257357 - https://gitlab.com/gitlab-org/gitlab/-/merge_requests/257523 - [x] MR 2 - Rename the frontend widget component and its files. - Move `.../widgets/risk_classification/` to `.../widgets/risk_assessment/`, and move its specs the same way. - Rename `MrRiskClassificationWidget` to `MrRiskAssessmentWidget` in `mr_widget_options.vue`. Keep the flag name `gon.features.showDuoMrRiskClassificationWidget` as is. - Rename internal identifiers, CSS classes, and test IDs that contain "classification". - Merge requests: - https://gitlab.com/gitlab-org/gitlab/-/merge_requests/259002 - [ ] MR 3 - Add a new REST path `risk_assessment`, and keep the old `risk_classification` path. - Rename `tools/risk_classification/results.rb` to `tools/risk_assessment/results.rb`. Serve both paths from one class. - Mark the old path as deprecated in its API description. - Regenerate the OpenAPI doc, the routes file, and the fine-grained token table. - Merge requests: - https://gitlab.com/gitlab-org/gitlab/-/merge_requests/261622 - [ ] MR 4 - Point the AI gateway at the new REST path. - This MR lives in the `gitlab-org/modelops/applied-ml/code-suggestions/ai-assist` repository (the AI gateway), not in `gitlab-org/gitlab`. - Update `RESULTS_PATH` in `duo_workflow_service/tools/risk_classification/submit_merge_request_risk_classification.py` to `/api/v4/ai/duo_workflows/tools/risk_assessment/results`. - Merge only after MR 3 is live on GitLab.com. - Merge requests: - https://gitlab.com/gitlab-org/modelops/applied-ml/code-suggestions/ai-assist/-/merge_requests/7425 - [ ] MR 5 - Remove the old `risk_classification` REST path. - Drop it from the namespace loop and drop its spec coverage. - Regenerate the OpenAPI doc, routes file, and token table again. - Wait until MR 4 is live, plus one milestone, to give self-managed Duo Workflow Service time to catch up. - Merge requests: - https://gitlab.com/gitlab-org/gitlab/-/merge_requests/261628 - [ ] MR 6 - Rename the backend namespace from `Gitlab::Duo::RiskClassification` to `Gitlab::Duo::RiskAssessment`. - Move the lib and spec folders. Update all callers. - Rename the GraphQL module `Types::MergeRequests::RiskClassification` to `RiskAssessment`. Keep every `graphql_name` unchanged. Add an explicit `graphql_name` to `TierEnum`. - Rename `Project#risk_classification_dap_available?` to `#risk_assessment_dap_available?`. - Can split into two smaller MRs if the diff is too large. - Merge requests: - https://gitlab.com/gitlab-org/gitlab/-/merge_requests/260052 - https://gitlab.com/gitlab-org/gitlab/-/merge_requests/261193 - https://gitlab.com/gitlab-org/gitlab/-/merge_requests/261592 - [ ] MR 7 - Rename the Sidekiq workers, step 1: add new classes, keep the old ones as shims. - Add `Ai::RiskAssessment::CalculateScoreWorker` and `Ai::RiskAssessment::TimeoutWorker`. Move their specs. - Keep the old `Ai::RiskClassification::*` classes for one release, as shims, so jobs already queued still run. - Regenerate `all_queues.yml` and `sidekiq_queues.yml`. - Merge requests: - https://gitlab.com/gitlab-org/gitlab/-/merge_requests/261626 - [ ] MR 8 - Remove the Sidekiq worker shims, one milestone after MR 7. - Delete the old `Ai::RiskClassification::*` shim workers. - Add a post-deploy migration to remove any leftover queued jobs for the old classes. - Regenerate the queue YAML files again. - Merge requests: - https://gitlab.com/gitlab-org/gitlab/-/merge_requests/261631 ## Order MR 1 and MR 2 do not depend on each other, but MR 2 should rebase on MR 1 if both change the same widget files. MR 3, MR 4, and MR 5 must merge in that order. MR 4 waits until MR 3 is live. MR 5 waits one milestone after MR 4 is live. MR 6 does not depend on the others. MR 7 must merge after MR 6, because the workers call the renamed lib code. MR 8 must merge one milestone after MR 7.