Merge Risk

| Merge Risk is CodeRabbit’s rating of how risky it is to merge a pull request as it stands. CodeRabbit assigns it at the end of each review, from the findings that remain and the context of the whole change, and shows it in the summary comment with a short explanation.

​

What Merge Risk measures

Merge Risk counts concrete risk that the pull request introduces or makes worse: in correctness, data integrity, security, availability, runtime and deployment behavior, permissions, and how hard the change is to roll back. Parts of the change that the review could not cover also count. It does not count how important the touched code is, general uncertainty about rolling out a change, design debt that existed before the pull request, tradeoffs the change makes on purpose, or the mere possibility of undiscovered bugs. The rating covers the whole pull request, not only the latest push. A risk that an earlier commit introduced keeps counting until a later commit resolves it.

​

Risk levels

Any remaining risk raises Merge Risk to at least Low.

​

Where you see it

CodeRabbit shows Merge Risk in its summary comment. The Merge Risk line gives the level and the first five characters of the commit SHA that the rating covers, followed by a paragraph that explains the risk. On Git providers that support collapsible sections, it appears as a collapsed Merge Risk section.

​

Which commit it covers

Each completed review produces a new rating for the commit it reviewed. After you push, the rating still describes the earlier commit until CodeRabbit reviews the new one, and approval waits until the new commit has its own rating. Approval risk limits use only a rating of the current commit.

​

When Merge Risk is unavailable

CodeRabbit produces no rating for a commit in cases such as these:

• The review did not complete, for example because some files failed to review or were too large to review.
• The new commit has nothing for CodeRabbit to review, for example because path filters exclude every changed file.
• CodeRabbit could not finish the final assessment of the review.
• CodeRabbit could not load the pull request’s earlier risk history, or a dependency security scan did not finish.
• On Azure DevOps, files were excluded for size or their diffs were unavailable.

In these cases, a merge risk limit treats the risk as unknown and CodeRabbit withholds its approval. A rating that CodeRabbit still shows from an earlier commit does not count.

​

What you can change

You cannot define or adjust how CodeRabbit scores Merge Risk. The rating follows from the risk the review finds. To lower it, address the risk that the explanation describes, then let CodeRabbit review the new commit. You choose how CodeRabbit acts on the rating. A merge risk limit sets the highest level at which CodeRabbit may approve the pull request.

​

Related assessments

Merge Risk is not the same as these other assessments:

• Security architecture risk rates the security impact of architecture-level changes. It comes from a Security Architecture Review and has its own approval limit.
• Risk in Triage rules and your Triage view is a Low, Medium, or High score that Triage calculates from other review signals. It does not use Merge Risk, so the two can differ for the same pull request.
• Merge readiness in Change Stack is a separate score that Change Stack places in the bands Ready, Caution, Risky, or Blocked.

​

What’s next