Abstract: In one example of the disclosure, a promotion artifact is received, the promotion artifact for implementation at a computer system. An origin environment is identified. A risk probability is determined for each of a set of artifacts included within the promotion artifact, the risk probability based upon a community rating and a count of artifact dependencies for the artifact. A risk impact is determined for each of the set of the artifacts. A risk assessment for implementation of the promotion artifact at the computer system is determined based upon the origin environment, and upon the risk probability and the risk impact determined for each of the artifacts.