Radius

Inspiration

Code review shows a diff. It does not show reach. In a group with shared libraries, a two line change can touch services another team owns, and the reviewer cannot see that from the merge request page. I built Radius to put the dependency graph where the decision happens.

What it does

Radius is a GitLab Duo custom flow that uses GitLab Orbit to review the blast radius of a merge request.

When invoked on a merge request, it reads the changed files, finds the definitions in them, finds importers of the changed module across the group, finds direct callers and their projects, finds test files in the affected projects, then posts one merge request note with affected projects, call sites, untested paths, the people who know the code, a risk level and the Orbit evidence behind every claim.

The note is a decision aid, not a chat answer. Every dependency is an edge in Orbit.

How I built it

• A custom flow on the GitLab Duo Agent Platform, defined in flow/radius.yaml.
• Orbit tools orbit_list_commands and orbit_invoke_command, with openCypher queries for definitions, imports, calls, files and merge request history.
• GitLab merge request tools for the diff, the note and reviewer context.
• A four project demo group: a shared pricing library, a checkout service with tests, a billing service without tests, and an unrelated notification service.

Challenges

• Orbit's public documentation describes a JSON query language, but the live API on GitLab.com uses openCypher. I verified the live schema and rewrote every query.
• The Cypher parser rejects OR and XOR, so test detection uses IN and separate queries.
• Cross-project Python imports do not resolve to a Definition. Orbit keeps them as ImportedSymbol nodes, so Radius matches on module path and symbol name instead of assuming a resolved import edge.
• Orbit indexes the default branch. A renamed file in an open merge request does not exist in the graph yet, so the flow reports the edges it can prove and states its caveats.

What I learned

Orbit is strongest when it answers a question a diff cannot: what is on the other side of this change. The hard part is not the query, it is deciding which edges count as evidence and saying plainly what the graph does not know.

What's next

• Add merge request ready as a native trigger and remove the mention step.
• Support CODEOWNERS and team routing.
• Add a policy gate for high impact changes.
• Cache graph results per project to keep large group reviews fast.

Built With

• ci/cd
• devsecops
• gitlab
• gitlab-duo-agent-platform
• python
• yaml