Parallax

Blast radius analysis for merge requests — powered by GitLab Orbit

Comment

Inspiration

Every engineer has a version of this story: you refactor a shared utility function, the diff looks clean, the reviewer approves, you merge — and twenty minutes later the pipeline is red across three modules you didn't know existed. No one warned you. The context was always there, buried in GitLab across MR history, pipeline logs, call graphs, and issue trackers. It just wasn't connected.

GitLab Orbit changes that. For the first time, your entire SDLC — source code, merge requests, pipelines, work items, security findings — lives in a single queryable knowledge graph. The moment we saw the traversal API, the idea was immediate: what if you could ask Orbit "what does this change actually touch?" before you merged?

That question became Parallax. In astronomy, parallax is the technique of observing the same object from two different positions to measure its true depth. That is exactly what this agent does — you see the MR diff from one angle, Parallax uses Orbit to show you the true depth behind it.

What It Does

Parallax is a GitLab Duo custom agent that activates on a merge request and answers one question: what is the real scope of this change?

When triggered by mentioning @parallax in an MR comment, it:

  1. Reads the MR diff to identify all changed files and functions
  2. Traverses the Orbit knowledge graph to find every function that calls the changed code — cross-file, cross-module, across the entire project
  3. Queries Orbit for linked work items connected to the affected code paths
  4. Aggregates pipeline failure history for the changed modules over the last 90 days
  5. Computes a risk score — LOW, MEDIUM, or HIGH
  6. Posts a structured Blast Radius Report as an MR comment — with tables the whole team can read in seconds

The reviewer no longer has to guess. They open the MR and immediately know whether the blast radius is 2 files or 20 — before a single approval is given.

How We Built It

GitLab Orbit REST API is the core engine, using three query types:

  • Traversal — following CALLS edges in reverse to find callers of changed functions, capped at depth 3, ranked by in-degree centrality
  • Relationship — following REFERENCES and IN_PROJECT edges to surface linked issues and epics
  • Aggregation — counting failed pipeline jobs grouped by module over a 90-day rolling window

GitLab Duo Agent Platform hosts Parallax as a custom skill triggered by @parallax mention or automatically on MR open.

Python 3.12 handles MR diff parsing (extracting function names from unified diff hunk headers), Orbit query orchestration, caller deduplication, and posting the final report via the GitLab REST API.

Challenges We Ran Into

Orbit is code-first, not diff-first. The MR diff gives file paths and line numbers; Orbit thinks in function definitions and node IDs. Bridging these required parsing diff hunk headers to extract function names before querying the graph — covering Python, Go, and JavaScript syntax.

Traversal depth versus noise. A naive caller traversal can explode — a logging utility technically has hundreds of callers. We capped depth at 3 and sorted by in-degree centrality to keep the report signal-rich rather than just long.

Graceful degradation. If Orbit has not indexed the project, the agent says so clearly. If a function has zero callers, the report shows that explicitly — zero callers is valid, useful data. The agent never silently fails.

Accomplishments That We're Proud Of

  • The report is immediately useful with zero onboarding — open the MR, read the table, understand the risk
  • Three Orbit query types chained into one coherent workflow inside a single agent
  • The risk score is fully explainable — the report shows exactly what drove it, so developers can agree or disagree rather than accept a black-box result
  • A local mock server makes the full pipeline runnable by anyone without Orbit Remote API access

What We Learned

Orbit's ontology is the real interface. Understanding which entities exist, which edges connect them, and which filters are supported is the prerequisite for everything. Time spent on the schema paid back many times over.

Agents are most powerful at decision points. Parallax works because it activates exactly when a human is about to make an irreversible decision — merging code. Delivering the right context at the right moment is what makes it actionable.

The knowledge graph is deeper than code. We started thinking of Orbit as a call graph tool. By the end we were querying pipeline history, work item relationships, and MR metadata through the same interface. The SDLC graph is a much richer object than code plus comments.

What's Next for Parallax

  • Auto-assign reviewers by call-graph ownership — Orbit knows who authored the functions that call your changed code
  • Blast radius trending per module sprint-over-sprint to surface architectural debt in real time
  • Orbit Local mode for air-gapped and self-hosted environments
  • VS Code sidebar — live blast radius estimate as you edit, before the MR is even opened
  • Security finding integration — flag CVEs and SAST findings on changed functions, making the risk score security-aware

Built With

  • gitlabduoagentplatform
  • gitlaborbitapi
  • pytest
  • python
  • restapi
Share this project:

Updates