Risk Level
The RL has the following properties:
Issues with info and muted severity are ignored by the risk level calculation. They are just informative, and have no effect on the risk.
A single critical issue makes the RL fall in the high risk range RL ≥ Ch; similarly, a single high severity issue makes the RL fall in the moderate risk range RL ≥ Cl. In accordance with the principle that "a chain is as strong as its weakest link," this holds true for issues within a project.
Monotonicity: RL should increase when (non-info) issues are added. RL should NOT INCREASE when a single issue is removed. In other terms: if A1 and A2 are sets of issues with A1 ⊆ A2, then RL(A1) ≤ RL(A2).
Also, if an issue changes to a higher severity, the RL should increase: more severe issues imply higher risk.
No issues, No Risk: RL(∅) = 0. When no issues were detected but analyses were run, the risk level is 0. Note: When no analysis is available for a project, then RL is undefined, NOT zero.
Averaged risk: For convenience, the RL for a group of projects, or for the organization could be computed using a weighted average on the RL of the projects.
Configuration
The relative weights for each issue type and severity, and the weight of each project in the global risk for the organization or project can be modified in the xygeni.risk-level.yml
configuration file.
The cutoff values for each risk category can be configured as well:
Last updated