#22974 ci: run the feat-cmux-next risk tier gate from main, enforced now

in progress (waiting on a maintainer's approval: this adds a pull_request_target workflow to main)

The feat-cmux-next risk tier gate has never run. GitHub runs pull_request_target workflows from the default branch, whatever the PR's base, and .github/workflows/risk-tier.yml exists only on feat-cmux-next. So:

• no feat PR gets a risk:* label or a risk evidence check;
• next-autoland treats the absent check as not applying;
• risk:high PRs merge with no person looking. #22781 (the updater ring, CmuxNextUpdater/*) merged that way at 03:52Z.

This PR adds the workflow to main. It's the same file as feat's, with two changes:

• It checks out scripts/ci/risk_tier.py at github.event.pull_request.base.sha (the feat-cmux-next commit), because main has no classifier. That's the trusted-feat-check pattern merge-freeze.yml uses. It never checks out or runs the PR's code.
• It enforces from now (ENFORCE_FROM: 2026-10-21T00:00:00Z), not from the feat copy's 2026-10-24.

It labels by path and fails risk evidence for a high PR until it has an approving review on the head commit from a collaborator other than the author, or a maintainer adds risk:human-ok. The Takes back #N hold applies to every tier.

Follow-up (leo-workspace, after this lands): next-autoland will hold a feat PR whose head has no risk evidence instead of treating it as not applying.

Risk: this adds a pull_request_target trigger, so it needs a maintainer's look before merge. Agents never approve it.

Changelog

none

Observed / Not run

Observed:

• The feat classifier run against #22781 (risk_tier.py pr --repo manaflow-ai/cmux --number 22781) gives tier=high label=risk:high ready=false, from the CmuxNextUpdater/* files.
• The YAML parses, with the trigger pull_request_target: branches [feat-cmux-next] and the same five steps.

Not run: actionlint (not installed on cmux16), and a live run (it only runs from main).

Agent session: cosmic-gray

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Makes the feat-cmux-next risk tier gate actually run by adding the workflow to main, where GitHub executes pull_request_target workflows. The gate previously existed only on feat-cmux-next, so no feat PR got a risk label or risk evidence check, and risk:high PRs merged without human review (e.g., #22781).

• Grades feat PRs by changed-file path using the classifier at the tip of feat-cmux-next (base.ref), never checking out or running the PR's code.
• Fetches the base's recent history to flag PRs that take back a change merged in the last week.
• Holds high-risk PRs from now (ENFORCE_FROM: 2026-10-21T00:00:00Z); a high PR stays red until an approving review on the head commit from a non-author collaborator, or a maintainer adds risk:human-ok.
• Follow-up (leo-workspace): next-autoland will hold a feat PR whose head lacks risk evidence rather than treating the check as not applying.

Migration
This adds a pull_request_target trigger, so a maintainer must review and merge this PR; agents never approve it.

Summary by CodeRabbit

• New Features

  • Added automated risk assessment for pull requests targeting the next-generation branch.
  • Pull requests are assigned low, normal, or high risk labels based on the assessment.
  • Low- and normal-risk changes can proceed automatically, while high-risk changes may require additional readiness checks.

• Chores

  • Risk evaluation runs are coordinated to prevent outdated results from overriding newer assessments.
  • Enforcement will transition from advisory to blocking after October 21, 2026.