feat(semconv-ai): standardize gen_ai.security.threat.* event and attribute names (#4096)

[FinalSunFlower]

Summary

• add the gen_ai.security.threat.detected event constant
• add standardized threat rule, category, severity, scanner, and action event attributes
• add constrained severity and action value enums
• add exact-value and dot-notation compliance tests

Testing

• python -m pytest packages/opentelemetry-semantic-conventions-ai/tests -q
• python -m ruff check packages/opentelemetry-semantic-conventions-ai/opentelemetry packages/opentelemetry-semantic-conventions-ai/tests

Closes #4096

Summary by CodeRabbit

• New Features

  • Added a standardized event for reporting detected AI security threats.
  • Added attributes covering threat rules, categories, severity, scanner details, and resulting actions.
  • Added standardized severity levels: low, medium, high, and critical.
  • Added standardized actions: blocked, warned, and logged.

• Tests

  • Added coverage validating the security-threat event, attributes, naming conventions, severity levels, and actions.

[CLAassistant]

All committers have signed the CLA.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: de554dd8-fc52-403e-aabe-18804a18dc90

📥 Commits

Reviewing files that changed from the base of the PR and between 4230be2 and 4635468.

📒 Files selected for processing (1)

• packages/opentelemetry-semantic-conventions-ai/tests/test_security_threat.py

🚧 Files skipped from review as they are similar to previous changes (1)

• packages/opentelemetry-semantic-conventions-ai/tests/test_security_threat.py

Included review availability: Your plan provides up to 8 included reviews per hour; 6 remain after this review.

---

📝 Walkthrough

Walkthrough

The semantic conventions package adds a GenAI security threat event, six threat attributes, severity and action enums, and tests for their serialized values and naming format.

Changes

GenAI security threat conventions

Layer / File(s)	Summary
Security threat schema packages/opentelemetry-semantic-conventions-ai/opentelemetry/semconv_ai/__init__.py	Adds the gen_ai.security.threat.detected event, six gen_ai.security.threat.* attributes, and enums for severity and action values.
Security threat validation packages/opentelemetry-semantic-conventions-ai/tests/test_security_threat.py	Tests the event value, attribute values, naming format, severity values, and action values.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Feature

Merge Risk: ⚪ Minimal · up to 46354

This change adds standardized threat event and attribute names without altering detection or runtime behavior, so it is mergeable with normal checks.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: adding standardized gen_ai.security.threat.* event and attribute names, including the new semantic convention definitions.
Linked Issues check	✅ Passed	The changes satisfy the coding requirements in issue #4096. Events adds gen_ai.security.threat.detected. EventAttributes adds all six required attributes. The severity enum contains low, `medi…
Out of Scope Changes check	✅ Passed	The changes stay within issue #4096. The enums, documentation, and tests support the additive event and attribute schema. No dashboards, evaluator helpers, or unrelated implementation are shown.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 5 functions across 2 files.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

---

_{Comment @coderabbitai help to get the list of available commands.}