chore(policy): turn on the duplicate, sensitive-paths and risk rules

.corbits-triage.yml

@@ -58,6 +58,26 @@ rules:
     reason: Hidden text can steer the rules a model judges.
     evidence:
       - maintainer-stated
+  - check: no-duplicate
+    text: Flag a pull request whose diff or commits match another open one.
+    reason: Two pull requests for the same change waste a review; the earlier one stays.
+    evidence:
+      - maintainer-stated
+  - check: duplicates-open-pull-request
+    text: Ask when a pull request overlaps another open one.
+    reason: A near duplicate needs a person to pick which one goes on.
+    evidence:
+      - maintainer-stated
+  - check: sensitive-paths
+    text: Route schema, migration, auth and secret changes to a person.
+    reason: A schema or auth change is hard to undo; CI config and lockfiles are noted.
+    evidence:
+      - maintainer-stated
+  - check: risk
+    text: Ask about high-risk pull requests and label medium-risk ones.
+    reason: A large change with no test touched needs a maintainer's eye.
+    evidence:
+      - maintainer-stated
   - id: no-ai-attribution
     check: text
     text: Titles, descriptions and commits carry no AI attribution.

.github/workflows/ci.yml

@@ -51,7 +51,7 @@ jobs:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           persist-credentials: false
-      - uses: corbitsdev/corbits-triage/packages/policy-check-action@0aa2ba2ebeadc02530e15c222306c7baa9b4330c
+      - uses: corbitsdev/corbits-triage/packages/policy-check-action@28a902e9a6e2f7ec53c581425b72d97c6800fc89
 
   publish:
     needs: check