RiskLogic contains the functionality for determining risk based on numeric input values
Summary
Functions
agentic_classification/1: returns classification label for agentic contribution ratio. Ratio represents the fraction of commits from bots or AI-assisted contributors. Returns "human", "mixed", or "agent".
last_commit_size_risk/1: returns a text enumeration for the risk based on the size of the last commit
commit_currency_risk/1: returns text enumeration for commit currency risk
contributor_risk/1: returns text enumeration for count
functional_commit_currency_risk/1: the risk from time since the last commit that carried information (#244).
functional_contributors_risk/1: returns the enumerated risk based on input contributors list
sbom_risk/1: returns text risk level for identified sbom_risk
Functions
agentic_classification/1: returns classification label for agentic contribution ratio. Ratio represents the fraction of commits from bots or AI-assisted contributors. Returns "human", "mixed", or "agent".
@spec commit_change_size_risk(non_neg_integer()) :: {:ok, String.t()}
last_commit_size_risk/1: returns a text enumeration for the risk based on the size of the last commit
@spec commit_currency_risk(non_neg_integer()) :: {:ok, String.t()}
commit_currency_risk/1: returns text enumeration for commit currency risk
@spec contributor_risk(non_neg_integer()) :: {:ok, String.t()}
contributor_risk/1: returns text enumeration for count
@spec functional_commit_currency_risk(non_neg_integer()) :: {:ok, String.t()}
functional_commit_currency_risk/1: the risk from time since the last commit that carried information (#244).
Configured separately from commit_currency_risk/1 on purpose. The last
substantive commit is always at or before the last commit of any kind, so
under shared thresholds this metric could only ever be the worse of the two
-- and since the report's verdict is a maximum, the plain metric could never
be the one that decides. Tuning one would silently move the other. These are
the levels that actually govern the verdict; commit_currency_* is kept as
it was so the two remain comparable in a report.
The fallbacks below are deliberately distinct from each other. Where
commit_currency_risk/1 falls back to 52 for both its high and critical
levels -- making "high" unreachable for a library consumer who configures
nothing -- every level here is reachable without configuration.
@spec functional_contributors_risk(non_neg_integer()) :: {:ok, String.t()}
functional_contributors_risk/1: returns the enumerated risk based on input contributors list
@spec sbom_risk() :: {:ok, String.t()}
sbom_risk/1: returns text risk level for identified sbom_risk