# How Code Review Graph (CRG) Scores the Risk of Changes in a Pull Request

> Discover how CRG calculates a risk score for pull request changes. Learn about blast radius, complexity, and test coverage impact to assess risk effectively.

- Repository: [Tirth Kanani/code-review-graph](https://github.com/tirth8205/code-review-graph)
- Tags: how-to-guide
- Published: 2026-08-08

---

**CRG calculates a normalized 0-100 risk score by applying a weighted heuristic to blast-radius reachability, complexity deltas, and test-coverage impact extracted from the PR diff.**

The **Code Review Graph (CRG)** is an open-source VS Code extension that transforms raw pull request diffs into quantifiable risk metrics. By analyzing the dependency graph and static properties of changed code, CRG provides reviewers with a data-driven priority score that highlights high-impact changes requiring closer scrutiny.

## Change Detection and Symbol Graph Construction

CRG begins risk analysis by parsing the PR diff into a structured symbol graph. The CLI backend processes the diff text and identifies affected functions, classes, and files.

### Diff Parsing in the CLI Backend

In [`code-review-graph-vscode/src/backend/cli.ts`](https://github.com/tirth8205/code-review-graph/blob/main/code-review-graph-vscode/src/backend/cli.ts), the `parseDiff` function extracts changed symbols from the raw Git diff. This module serves as the entry point for the risk calculation pipeline, converting textual patches into traversable graph nodes.

## The Risk Calculation Pipeline

CRG derives its risk score from three primary signals, each weighted to reflect its relative impact on system stability.

### 1. Blast Radius Analysis

The **blast radius** measures how many downstream components depend on the changed code. In [`code-review-graph-vscode/src/features/blastRadius.ts`](https://github.com/tirth8205/code-review-graph/blob/main/code-review-graph-vscode/src/features/blastRadius.ts), the `calculateBlastRadius` function traverses the dependency graph to count reachable files, functions, and classes. Changes affecting critical shared libraries or widely-used utilities receive exponentially higher risk contributions due to their extensive reachability.

### 2. Complexity and Churn Metrics

Code complexity deltas and historical churn data quantify the inherent instability of the modified regions. The `getComplexityDelta` function in [`code-review-graph-vscode/src/features/reviewAssistant.ts`](https://github.com/tirth8205/code-review-graph/blob/main/code-review-graph-vscode/src/features/reviewAssistant.ts) computes cyclomatic complexity changes, while churn metrics track how frequently the modified lines have changed in recent history. High complexity coupled with high churn indicates volatile code that poses elevated regression risks.

### 3. Test Coverage Impact

CRG evaluates how changes affect the test suite's safety net by querying coverage data stored in SQLite. The `getCoverageImpact` function in [`code-review-graph-vscode/src/features/reviewAssistant.ts`](https://github.com/tirth8205/code-review-graph/blob/main/code-review-graph-vscode/src/features/reviewAssistant.ts) retrieves statistics from [`code-review-graph-vscode/src/backend/sqlite.ts`](https://github.com/tirth8205/code-review-graph/blob/main/code-review-graph-vscode/src/backend/sqlite.ts), measuring whether edits touch covered code, uncover previously tested lines, or modify regions with zero test coverage. Decreases in coverage or modifications to untested paths directly increase the risk score.

## The Scoring Algorithm

CRG aggregates these signals using the `computeRiskScore` function in [`code-review-graph-vscode/src/features/reviewAssistant.ts`](https://github.com/tirth8205/code-review-graph/blob/main/code-review-graph-vscode/src/features/reviewAssistant.ts). The algorithm applies a fixed weighted formula:

- **40%** blast radius
- **35%** complexity delta
- **25%** coverage impact

The normalized components sum to a 0-100 risk value, with higher scores indicating greater probability of regression or unexpected side effects.

```typescript
// Example: Computing the risk score for a PR (simplified)
import { parseDiff } from './backend/cli';
import { calculateBlastRadius } from './features/blastRadius';
import { getComplexityDelta, getCoverageImpact } from './features/reviewAssistant';

async function scorePR(diffText: string) {
  const changes = await parseDiff(diffText);
  const blast = calculateBlastRadius(changes);
  const complexity = getComplexityDelta(changes);
  const coverage = getCoverageImpact(changes);

  // Heuristic weighting
  const risk = (blast * 0.4) + (complexity * 0.35) + (coverage * 0.25);
  return Math.min(100, Math.round(risk));
}

```

## Risk Visualization in VS Code

Once calculated, CRG surfaces the risk score through the VS Code interface to guide reviewer attention. The extension renders a color-coded badge that maps numeric scores to severity levels.

### Status Bar Integration

In [`code-review-graph-vscode/src/views/statusBar.ts`](https://github.com/tirth8205/code-review-graph/blob/main/code-review-graph-vscode/src/views/statusBar.ts), the extension displays the computed score using a traffic-light color scheme: **green** for low risk (0-39), **yellow** for moderate risk (40-70), and **red** for high risk (71-100). This immediate visual cue allows reviewers to prioritize high-risk PRs without manual file-by-file inspection.

```typescript
// Example: Rendering the risk badge in the VS Code status bar
import { window } from 'vscode';
import { scorePR } from './reviewAssistant';

async function showRisk(diff: string) {
  const risk = await scorePR(diff);
  const colour = risk > 70 ? 'red' : risk > 40 ? 'yellow' : 'green';
  window.setStatusBarMessage(`PR Risk: ${risk}%`, colour);
}

```

## Summary

- CRG initiates analysis in [`code-review-graph-vscode/src/backend/cli.ts`](https://github.com/tirth8205/code-review-graph/blob/main/code-review-graph-vscode/src/backend/cli.ts) by parsing PR diffs into a symbol graph
- The `calculateBlastRadius` function in [`blastRadius.ts`](https://github.com/tirth8205/code-review-graph/blob/main/blastRadius.ts) measures dependency reachability to quantify structural impact
- Complexity deltas and coverage impacts are calculated in [`reviewAssistant.ts`](https://github.com/tirth8205/code-review-graph/blob/main/reviewAssistant.ts) using data from [`sqlite.ts`](https://github.com/tirth8205/code-review-graph/blob/main/sqlite.ts)
- The `computeRiskScore` function applies a 40/35/25 weighted formula to generate a normalized 0-100 risk value
- Final scores render as color-coded badges via [`statusBar.ts`](https://github.com/tirth8205/code-review-graph/blob/main/statusBar.ts), enabling risk-based review prioritization

## Frequently Asked Questions

### How does CRG define "blast radius" for a pull request?

**Blast radius** refers to the count of downstream files, functions, and classes reachable through the dependency graph from changed symbols. The `calculateBlastRadius` function in [`code-review-graph-vscode/src/features/blastRadius.ts`](https://github.com/tirth8205/code-review-graph/blob/main/code-review-graph-vscode/src/features/blastRadius.ts) traverses the symbol graph to compute this metric, assigning higher risk to changes that affect critical shared components or widely-used utilities.

### What data source does CRG use for test coverage information?

CRG retrieves coverage statistics from a local SQLite database managed in [`code-review-graph-vscode/src/backend/sqlite.ts`](https://github.com/tirth8205/code-review-graph/blob/main/code-review-graph-vscode/src/backend/sqlite.ts). The `getCoverageImpact` function queries this store to determine whether changes improve, degrade, or leave unaffected the overall test coverage, with coverage decreases directly raising the final risk score.

### Can teams customize the risk scoring weights in CRG?

The current implementation uses fixed weights—40% blast radius, 35% complexity, and 25% coverage—hardcoded in the `computeRiskScore` function within [`code-review-graph-vscode/src/features/reviewAssistant.ts`](https://github.com/tirth8205/code-review-graph/blob/main/code-review-graph-vscode/src/features/reviewAssistant.ts). While the open-source nature allows developers to modify these constants in the source code, the extension does not provide user-configurable settings for these weights at runtime.

### Where does CRG display the risk score during code review?

CRG presents the risk score as a color-coded badge in the VS Code status bar through the implementation in [`code-review-graph-vscode/src/views/statusBar.ts`](https://github.com/tirth8205/code-review-graph/blob/main/code-review-graph-vscode/src/views/statusBar.ts). Scores render as **green** for low risk (0-39), **yellow** for moderate (40-70), and **red** for high (71-100), providing reviewers with immediate visual prioritization cues.