ci: add PR risk experiment workflow

[betegon]

Overview

Adds the PR Risk Action as an advisory workflow for non-draft pull requests. It runs on pull_request_target so it can keep the risk: low|medium|high label in sync, but it does not checkout or execute PR code.

The Action now has a bundled getsentry__sentry-dotnet profile in getsentry/pr-risk-action@v0, so this repo does not need to vendor any scorer code or model artifacts.

Validation

• Built a full sentry-dotnet profile from GitHub API pull request history: 3,286 PRs from 2018-05-22 to 2026-07-01, reviews skipped.
• Verified getsentry/pr-risk-action@v0 includes the sentry-dotnet profile and can score getsentry/sentry-dotnet#5333 locally.
• Ran the pr-risk-action unit tests: 39 tests passing.
• Checked the workflow contains the expected trigger, permissions, draft guard, and Action reference.

#skip-changelog

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 74.16%. Comparing base (951d98f) to head (3302320).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #5334      +/-   ##
==========================================
+ Coverage   74.15%   74.16%   +0.01%     
==========================================
  Files         508      508              
  Lines       18353    18353              
  Branches     3586     3586              
==========================================
+ Hits        13610    13612       +2     
+ Misses       3870     3869       -1     
+ Partials      873      872       -1     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[jamescrosswell]

Thanks @betegon - looks interesting!

btw: It took me a while to work out what it does so I made a PR on the action repo tweaking the README.md file.

[betegon]

thanks for the PR @jamescrosswell ! @dingsdax told me was up for trying the action out in this repo but i forgot to put him as reviewer 😆. Thanks for reviewing it.

It will make some mistakes now but i'll be improving it.

[jamescrosswell]

It will make some mistakes now but i'll be improving it.

@betegon yeah it's interesting - it flagged this one as medium risk, for example:

• chore(deps): update Cocoa SDK to v9.19.1 #5336

That's just one of our regular/weekly dependency bumps (automatically generated PR). Technically, we probably will follow up with another PR within 30 days (just because the Cocoa team tend to make more than one release per month)... but I wouldn't otherwise see any reason for that PR to be medium/high risk.

It's only categorised two PRs so far though - we'll get a better feel for it's overall reliability after a month or two of using it.