How Code Review Graph (CRG) Scores the Risk of Changes in a Pull Request

CRG calculates a normalized 0-100 risk score by applying a weighted heuristic to blast-radius reachability, complexity deltas, and test-coverage impact extracted from the PR diff.

The Code Review Graph (CRG) is an open-source VS Code extension that transforms raw pull request diffs into quantifiable risk metrics. By analyzing the dependency graph and static properties of changed code, CRG provides reviewers with a data-driven priority score that highlights high-impact changes requiring closer scrutiny.

Change Detection and Symbol Graph Construction

CRG begins risk analysis by parsing the PR diff into a structured symbol graph. The CLI backend processes the diff text and identifies affected functions, classes, and files.

Diff Parsing in the CLI Backend

In code-review-graph-vscode/src/backend/cli.ts, the parseDiff function extracts changed symbols from the raw Git diff. This module serves as the entry point for the risk calculation pipeline, converting textual patches into traversable graph nodes.

The Risk Calculation Pipeline

CRG derives its risk score from three primary signals, each weighted to reflect its relative impact on system stability.

1. Blast Radius Analysis

The blast radius measures how many downstream components depend on the changed code. In code-review-graph-vscode/src/features/blastRadius.ts, the calculateBlastRadius function traverses the dependency graph to count reachable files, functions, and classes. Changes affecting critical shared libraries or widely-used utilities receive exponentially higher risk contributions due to their extensive reachability.

2. Complexity and Churn Metrics

Code complexity deltas and historical churn data quantify the inherent instability of the modified regions. The getComplexityDelta function in code-review-graph-vscode/src/features/reviewAssistant.ts computes cyclomatic complexity changes, while churn metrics track how frequently the modified lines have changed in recent history. High complexity coupled with high churn indicates volatile code that poses elevated regression risks.

3. Test Coverage Impact

CRG evaluates how changes affect the test suite's safety net by querying coverage data stored in SQLite. The getCoverageImpact function in code-review-graph-vscode/src/features/reviewAssistant.ts retrieves statistics from code-review-graph-vscode/src/backend/sqlite.ts, measuring whether edits touch covered code, uncover previously tested lines, or modify regions with zero test coverage. Decreases in coverage or modifications to untested paths directly increase the risk score.

The Scoring Algorithm

CRG aggregates these signals using the computeRiskScore function in code-review-graph-vscode/src/features/reviewAssistant.ts. The algorithm applies a fixed weighted formula:

• 40% blast radius
• 35% complexity delta
• 25% coverage impact

The normalized components sum to a 0-100 risk value, with higher scores indicating greater probability of regression or unexpected side effects.

// Example: Computing the risk score for a PR (simplified)
import { parseDiff } from './backend/cli';
import { calculateBlastRadius } from './features/blastRadius';
import { getComplexityDelta, getCoverageImpact } from './features/reviewAssistant';

async function scorePR(diffText: string) {
  const changes = await parseDiff(diffText);
  const blast = calculateBlastRadius(changes);
  const complexity = getComplexityDelta(changes);
  const coverage = getCoverageImpact(changes);

  // Heuristic weighting
  const risk = (blast * 0.4) + (complexity * 0.35) + (coverage * 0.25);
  return Math.min(100, Math.round(risk));
}

Risk Visualization in VS Code

Once calculated, CRG surfaces the risk score through the VS Code interface to guide reviewer attention. The extension renders a color-coded badge that maps numeric scores to severity levels.

Status Bar Integration

In code-review-graph-vscode/src/views/statusBar.ts, the extension displays the computed score using a traffic-light color scheme: green for low risk (0-39), yellow for moderate risk (40-70), and red for high risk (71-100). This immediate visual cue allows reviewers to prioritize high-risk PRs without manual file-by-file inspection.

// Example: Rendering the risk badge in the VS Code status bar
import { window } from 'vscode';
import { scorePR } from './reviewAssistant';

async function showRisk(diff: string) {
  const risk = await scorePR(diff);
  const colour = risk > 70 ? 'red' : risk > 40 ? 'yellow' : 'green';
  window.setStatusBarMessage(`PR Risk: ${risk}%`, colour);
}

Summary

• CRG initiates analysis in code-review-graph-vscode/src/backend/cli.ts by parsing PR diffs into a symbol graph
• The calculateBlastRadius function in blastRadius.ts measures dependency reachability to quantify structural impact
• Complexity deltas and coverage impacts are calculated in reviewAssistant.ts using data from sqlite.ts
• The computeRiskScore function applies a 40/35/25 weighted formula to generate a normalized 0-100 risk value
• Final scores render as color-coded badges via statusBar.ts, enabling risk-based review prioritization

Frequently Asked Questions

How does CRG define "blast radius" for a pull request?

Blast radius refers to the count of downstream files, functions, and classes reachable through the dependency graph from changed symbols. The calculateBlastRadius function in code-review-graph-vscode/src/features/blastRadius.ts traverses the symbol graph to compute this metric, assigning higher risk to changes that affect critical shared components or widely-used utilities.

What data source does CRG use for test coverage information?

CRG retrieves coverage statistics from a local SQLite database managed in code-review-graph-vscode/src/backend/sqlite.ts. The getCoverageImpact function queries this store to determine whether changes improve, degrade, or leave unaffected the overall test coverage, with coverage decreases directly raising the final risk score.

Can teams customize the risk scoring weights in CRG?

The current implementation uses fixed weights—40% blast radius, 35% complexity, and 25% coverage—hardcoded in the computeRiskScore function within code-review-graph-vscode/src/features/reviewAssistant.ts. While the open-source nature allows developers to modify these constants in the source code, the extension does not provide user-configurable settings for these weights at runtime.

Where does CRG display the risk score during code review?

CRG presents the risk score as a color-coded badge in the VS Code status bar through the implementation in code-review-graph-vscode/src/views/statusBar.ts. Scores render as green for low risk (0-39), yellow for moderate (40-70), and red for high (71-100), providing reviewers with immediate visual prioritization cues.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}