Risk Score¶
This guide explains how CloudAEye assesses whether a pull request needs closer human review, why, and who should review it.
Overview¶
CloudAEye analyzes the changed files, their history, and the author's pull requests when you comment @cloudaeye /risk_score in the PR timeline.
The analysis looks at the last 21 days and includes the pull request's AI Slop Score. The result includes an overall risk score, a recommendation, and the evidence behind the concerns. Use it before deciding how carefully to review an open pull request or whom to ask for a review.
Prerequisites¶
Step 1: Register¶
Sign up with CloudAEye SaaS.
Step 2: Setup Code Review¶
Setup Code Review by following the Getting Started guide.
Generate Risk Score¶
To assess an open pull request, comment the following in the PR timeline:
@cloudaeye /risk_score
CloudAEye analyzes the pull request and adds a Change Risk Card to the PR conversation.
The AI slop review is reused when current evidence exists for this commit; otherwise, CloudAEye runs it as part of the assessment. The command reads existing bug notes rather than creating or updating them.
Change Risk Card¶
The card includes:
- The PR author, an overall risk score out of 100, and its risk band.
- This pull request's AI slop score and a summary of its findings.
- A recommendation, the next step, and suggested reviewers when available.
- Up to four ranked concerns naming relevant files, issues, or pull requests, followed by what looks fine.
- Collapsed evidence showing week-by-week trends, changed files, and bug history.
Risk Signals¶
| Signal | Description |
|---|---|
| File bug history | Bugs reported against the changed files, including unresolved bugs |
| Code rework | How much recently added code was already rewritten |
| Code ownership | Who owns the changed code and whose lines the PR rewrites |
| Author history | Bugs in the author's code, recent rework, and pull-request setbacks such as reverts or closed-unmerged PRs |
| AI slop | Code quality signals on this commit and the author's earlier pull requests |
| Test coverage | Coverage evidence when a CloudAEye PR checklist ran on this commit |
Weekly trends show how the evidence changed over the window and whether it is getting better or worse.
Score and Risk Bands¶
CloudAEye reports a score out of 100 and one of the following bands when enough evidence is available:
- Low
- Medium
- High
The recommendation states whether human review is required or no extra review is needed, with a next step when appropriate. It is advisory: the command does not approve or merge the pull request.
Scores are not calibrated yet and may change as more merged pull requests are measured. The report does not expose scoring weights or formulas.
Incomplete Evidence¶
Missing evidence is reported as not measured, never as having no issues. With too little evidence, the card cannot name a risk band and asks for human review.
Risk Score does not replace a code review. Use Review Code to check for bugs and security vulnerabilities.