A team wants a GitHub Actions workflow that labels Copilot-created pull requests based on path risk. Changes under docs/** should be treated as low risk. Changes under src/auth/**, infra/deploy/**, or compliance/** should be marked for human intervention before privileged workflows or merge decisions. Which option completes the workflow?

name: classify-agent-risk

on:
  (Missing value 1):
    types: [opened, synchronize, reopened]

permissions:
  contents: read
  pull-requests: read
  issues: write

jobs:
  classify:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

        - name: Detect changed files
          id: changes
          uses: dorny/paths-filter@v3
          with:
            filters: |
              low:
                - 'docs/**'
              high:
                - 'src/auth/**'
                - 'infra/deploy/**'
                - 'compliance/**'

        - name: Apply high-risk label
          if: steps.changes.outputs.high == 'true'
          run: |
            gh pr edit "${{ github.event.pull_request.number }}" \
               --add-label "(Missing value 2)"
          env:
            GH_TOKEN: ${{ github.token }}

        - name: Apply low-risk label
          if: steps.changes.outputs.high != 'true' && steps.changes.outputs.low == 'true'
          run: |
            gh pr edit "${{ github.event.pull_request.number }}" \
               --add-label "(Missing value 3)"
          env:
            GH_TOKEN: ${{ github.token }}