Change risk visualization and intelligent review method and system for code review
By constructing a code impact subgraph and multi-dimensional risk features, combined with intelligent routing and adaptive gate control, the problems of inaccurate risk identification and inaccurate resource allocation in code review are solved, and efficient code change risk management is achieved.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- 粤港澳大湾区(广东)国创中心
- Filing Date
- 2026-04-27
- Publication Date
- 2026-07-24
AI Technical Summary
Existing code review processes struggle to accurately identify change risks at the line or logic segment level, lack understanding of code context, have inaccurate assignment of reviewers, lack adaptability in merge control strategies, and are difficult to integrate with gray-scale verification.
By acquiring metadata and difference data of code changes, we construct call graphs, dependency graphs, ownership graphs, and test association graphs, extract multidimensional risk features, calculate risk assessment scores using risk assessment models, dynamically allocate reviewers and review depths, and perform merged verification in conjunction with predefined gate control strategies.
This improved the accuracy of line-level risk identification, enabled precise allocation of review resources, reduced the accident rate of change merging, and enhanced the security and reliability of code reviews.
Smart Images
Figure CN122450796A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of software development technology, and in particular to a method and system for visualizing and intelligently reviewing change risks for code review. Background Technology
[0002] In large-scale distributed / microservice systems, code changes frequently trigger online risks, exhibiting a cascading effect where single points of failure can impact core business operations. Therefore, effectively identifying and controlling change risks is a significant challenge for ensuring software quality and system reliability.
[0003] Current code review processes rely heavily on reviewers' experience, with reviews often limited to the file / commit level, making it difficult to quickly identify high-risk logic. Furthermore, while the industry has adopted single-dimensional data such as static analysis tools and code coverage reports to assist in reviews, this data is often isolated and lacks the ability to comprehensively assess code context, historical performance, and runtime risks.
[0004] To address these issues, exploratory solutions such as code change risk visualization systems have emerged in the industry, forming a certain system in terms of risk characteristic definition, assessment models, and visualization. However, these solutions still have many shortcomings. First, the risk identification granularity is too coarse, making it difficult to pinpoint the exact line of code or logical segment for heat warnings, leading to blind spots in review. Second, there is insufficient understanding of the code context, lacking the ability to perform semantic consistency verification by combining code graphs (such as call relationships and dependencies), data flow, and change intent (such as PR / MR descriptions). Third, the allocation mechanism for reviewers is relatively static, mostly based on directory affiliation or historical commit records, failing to effectively combine reviewers' skills and expertise with past defect repair records for precise routing. Finally, the merge gate control strategy is too rigid, lacking the ability to adaptively adjust based on risk characteristic combinations, making it difficult to effectively link with processes such as canary release verification. Summary of the Invention
[0005] In view of the above problems, the present invention is proposed to provide a method for visualizing and intelligently reviewing change risks for code review, and a corresponding system for visualizing and intelligently reviewing change risks for code review, which overcomes or at least partially solves the above problems.
[0006] This invention discloses a method for visualizing and intelligently reviewing change risks for code reviews, the method comprising: In response to code change events, obtain the metadata and difference data of the code change, and parse the change intent information based on the metadata; Based on the discrepancy data, the affected code elements are extracted from the code repository, and a code impact subgraph related to the affected code elements is incrementally constructed based on the static analysis results. The code impact subgraph includes a call graph, dependency graph, ownership graph, and test association graph. Based on the differential data and code impact subgraph, risk features are extracted to form a multi-dimensional feature vector. The risk features include static risk features, historical risk features, dynamic risk features, and semantic risk features. The multidimensional feature vector is input into the risk assessment model to calculate the risk assessment score of the code change, and a line-level risk heat map is generated based on the risk assessment score for display on the code review interface. Based on the risk assessment score and ownership diagram, the list of reviewers and the required depth of review are dynamically determined, and corresponding review tasks are generated. Before performing the code merging operation, the code is validated based on the risk assessment score, review results, and predefined gate control policies. If the validation passes, the merge is approved; if the validation fails, the merge is blocked and the reason for the block is output.
[0007] Optionally, in response to a code change event, metadata and difference data of the code change are obtained, and change intent information is obtained based on the metadata parsing, including: In response to code change events, retrieve metadata, a list of file changes, and commit history for code merge requests or code review requests; Obtain code difference data from the file change list, parse the code abstract syntax tree of the difference data, extract the boundaries of the changed functions, classes, and modules, and obtain the changed code structure information; Based on the titles and descriptions in the submission history, a pre-trained language model is used to perform semantic encoding to obtain the semantic information of the changed text. By integrating the structural information of the changed code with the semantic information of the changed text, a vector representation of the change intent information is generated.
[0008] Optionally, based on the discrepancy data, affected code elements are extracted from the code repository, and a code impact subgraph related to the affected code elements is incrementally constructed based on the static analysis results, including: A function-level call graph is constructed based on static analysis tools, and incremental updates are performed on the functions and their call chains that have changed. Parse dependency configuration files, build module-level dependency graphs, and determine the dependent modules affected by changes; Parse ownership configuration files and code commit history to establish a mapping between files and developers, forming an ownership graph to determine the code owner of the changed files; By using code coverage reports and test case naming conventions, the relationship between code changes and test cases is established, forming a test relationship graph; Parse the service interface definition file, annotate the interface contracts and traffic routing mappings between services, and incorporate the mapping relationships into the code influence subgraph.
[0009] Optionally, based on the differential data and code impact subgraph, risk features are extracted to form a multi-dimensional feature vector, including: Calculate the cyclomatic complexity, cognitive complexity, and nesting depth of the modified code, identify exception handling paths and sensitive operation patterns, and form static risk characteristics; Query historical defect records, calculate the historical defect density of changed files or modules, analyze code rollback records to count rollback frequency, and calculate the time interval since the last modification to form historical risk characteristics; The code coverage report is analyzed to identify uncovered lines of code, function call frequency and response latency are obtained based on application performance management data, and alarm records in the pre-release environment are queried to form dynamic risk characteristics; Calculate the semantic similarity between the change intent information and the actual code change, and use a pre-trained model to identify common error-prone patterns in the code to form semantic risk features; Static risk features, historical risk features, dynamic risk features, and semantic risk features are combined into a multidimensional feature vector.
[0010] Optionally, the multidimensional feature vector is input into the risk assessment model to calculate the risk assessment score for code changes, and a line-level risk heatmap is generated based on the risk assessment score for display on the code review interface, including: The multidimensional feature vector is input into a trained machine learning model, which outputs the initial risk probability. The initial risk probability is adjusted using preset expert rules to obtain a risk assessment score; The contribution of each risk feature in the multidimensional feature vector to the risk assessment score is calculated using the interpretability analysis method, and the corresponding natural language explanation is generated. The risk assessment score is broken down to the line level, and the source of each risk characteristic is traced to generate a line-level risk heat map for display in the code review interface.
[0011] Optionally, based on the risk assessment score and ownership diagram, the list of reviewers and the required depth of review can be dynamically determined, including: Based on the ownership graph and code commit history, candidate reviewers related to code changes are selected from the developer pool; Based on the skill areas involved in the code change, match the skill profiles of the candidate reviewers, query the number of tasks to be reviewed and the average review cycle for each candidate reviewer, and perform load balancing calculations to determine the list of reviewers. The required depth of review is dynamically determined based on the risk level range in which the risk score falls. The required depth of review includes at least the number of reviewers required, their qualification level, and whether a re-review is required.
[0012] Optionally, before performing the code merging operation, a verification is performed based on the risk assessment score, review results, and predefined gate control policies. If the verification passes, the merge is approved; if the verification fails, the merge is blocked, and the reason for the block is output, including: Load the basic strategy, risk strategy, and compliance strategy, and verify them based on the risk assessment score and review results; wherein the risk strategy includes triggering additional re-evaluation and gray-scale verification based on the risk score. When the risk assessment score is higher than the preset threshold, the pre-release environment deployment is automatically triggered, and key operating indicators are monitored. If the key operating indicators are normal, the gray-scale verification is deemed to have passed. If the key operating indicators are abnormal, an alarm is generated and the merging is blocked.
[0013] Optionally, the method further includes: The change intent information and the difference data are input into the large language model, which outputs an intent-code consistency score and an explanation of inconsistencies. The consistency score is then incorporated into the multidimensional feature vector as an additional semantic risk feature. And / or, The large language model generates test strategy suggestions based on the difference data and the risk assessment score, and generates unit test code frameworks based on the test strategy suggestions; the test strategy suggestions include test scenarios, boundary conditions and abnormal test cases.
[0014] Optionally, before performing the code merging operation and before the step of verifying based on risk assessment scores, review results, and predefined gate control policies, the following may also be included: The discrepancy data is subjected to sensitive code fragment identification; the sensitive code fragments include at least code patterns related to payment logic, permission verification, data encryption, and financial calculation. When a sensitive code segment is identified, a corresponding enhanced gate control template is loaded according to the type and level of the sensitive code segment; the enhanced gate control template includes at least one of the following: mandatory approval by a designated security team or finance team, requirement for double review, mandatory passage of penetration testing or reconciliation testing, and mandatory execution of canary release; The gate control conditions in the enhanced gate control template are superimposed onto the predefined gate control strategy, and verification is performed based on the superimposed gate control strategy.
[0015] This invention also discloses a change risk visualization and intelligent review system for code review, the system comprising: The data acquisition layer is used to respond to code change events, obtain metadata and difference data of code changes, and parse the change intent information based on the metadata; The code graph construction layer is used to extract affected code elements from the code repository based on the difference data, and incrementally construct code influence subgraphs related to the affected code elements based on the static analysis results. The code influence subgraphs include call graphs, dependency graphs, ownership graphs, and test association graphs. The risk feature extraction layer is used to extract risk features based on differential data and code influence subgraphs, forming a multi-dimensional feature vector. Risk features include static risk features, historical risk features, dynamic risk features, and semantic risk features. The risk assessment and interpretation layer is used to input multi-dimensional feature vectors into the risk assessment model, calculate the risk assessment score of code changes, and generate a line-level risk heat map for display on the code review interface based on the risk assessment score. The intelligent routing layer is used to dynamically determine the list of reviewers and the required review depth based on the risk assessment score and ownership map, and to generate corresponding review tasks. The strategy and gate control layer is used to verify the code merging operation based on the risk assessment score, review results, and predefined gate control policies before execution. If the verification passes, the merge is approved; if the verification fails, the merge is blocked and the reason for the block is output.
[0016] This invention has the following advantages: This invention responds to code change events, acquires metadata and discrepancy data, and parses the change intent; it constructs a code impact subgraph containing calls, dependencies, ownership, and test associations based on incremental discrepancy data; it extracts multi-dimensional risk features such as static, historical, dynamic, and semantic characteristics by combining discrepancy data and the impact subgraph to form feature vectors; it calculates risk scores using a risk assessment model and generates row-level heatmaps; it dynamically allocates reviewers and depth requirements based on risk scores and ownership graphs; and finally, it performs merge verification based on risk scores, review results, and gate control strategies. This invention, through fine-grained risk identification and visualization, refines the assessment granularity to the row level, significantly improving the accuracy of high-risk logic location; combined with intelligent routing and adaptive gate control, it achieves precise allocation of review resources and risk-driven merge management, effectively reducing the merge incident rate introduced by changes. Attached Figure Description
[0017] Figure 1 This is a flowchart of the change risk visualization and intelligent review method for code review provided in this embodiment of the invention; Figure 2 This is a schematic diagram of the code review interface provided in an embodiment of the present invention; Figure 3 This is a structural block diagram of the change risk visualization and intelligent review system for code review provided in this embodiment of the invention. Detailed Implementation
[0018] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments.
[0019] Reference Figure 1 The specific implementation of the change risk visualization and intelligent review method for code review of this invention may include the following steps: S1 Change Analysis: Function Description: Obtain PR / MR metadata and Diff, and parse the submission title / description to form change intent text.
[0020] Data flow: Webhook event (PR ID, source branch, target branch, commit SHA) → Git platform API call → list of changed files + Diff data → NLP semantic encoding → change intent vector.
[0021] Specific implementation method: 1) Listen for Git platform webhook events to trigger the change resolution process; 2) Call the REST API to retrieve PR / MR metadata, file change list, and commit history; 3) Use Tree-sitter to parse the code AST and extract the boundaries of changed functions / classes / modules; 4) Use a pre-trained language model to semantically encode the submitted title and description to generate a change intent vector representation.
[0022] S2 Influence Map Construction: Function Description: Incremental build changes affect sub-graphs (call graph, dependency graph, ownership graph, test association graph), annotating cross-service interface contracts and traffic routing mappings.
[0023] Data flow: Change file list + full code repository → static analysis → incremental update of call graph / dependency graph → ownership mapping + test association → change impact subgraph (JSON format node-edge structure).
[0024] Specific implementation method: 1) Call graph: Function-level call relationships are constructed based on static analysis tools, and incremental updates only handle the changed functions and their call chains; 2) Dependency graph: Parse the dependency configuration files (package.json / pom.xml / requirements.txt) and build the module-level dependency topology; 3) Ownership graph: Parse the CODEOWNERS file and git blame history to establish a file-developer ownership mapping; 4) Test Relationship Graph: Establish the relationship between code changes and test cases through code coverage reports and test naming conventions; 5) Cross-service mapping: Parse API definitions (OpenAPI / gRPC) and configuration files, and annotate inter-service interface contracts and traffic routes.
[0025] S3 Feature Extraction: Function Description: Extract static risks (complexity, abnormal paths, sensitive interfaces / configurations), historical risks (defect rate, rollback history, time series factors), dynamic risks (coverage gaps, critical path traffic, pre-release alerts, diffusion degree), and semantic risks (intent-code consistency, error-prone patterns) to form feature vectors.
[0026] Data flow: Change impact subgraph + Diff data + historical defect database + CI log + APM data → parallel feature calculation → feature normalization → multi-dimensional feature vector (50-100 dimensions).
[0027] Specific implementation method: 1) Static risks: computational cyclomatic complexity, cognitive complexity, nesting depth; identification of try-catch blocks and exception throwing points; matching predefined sensitive operation patterns (database writes, external API calls, permission checks); 2) Historical Risks: Query the defect tracking system to calculate the historical defect density of files / modules; analyze git revert records to count the rollback frequency; calculate the time interval since the last modification and the modification frequency; 3) Dynamic Risks: Parse code coverage reports to identify uncovered lines; integrate APM data to obtain function call QPS and latency; query pre-release environment alert records; 4) Semantic risks: Calculate the semantic similarity between the change intent vector and the actual code change; use a pre-trained model to identify common error-prone patterns (null pointer, resource leak, concurrency issues).
[0028] S4 Risk Assessment and Interpretation: Function Description: RiskEngine combines the trained model with rule enhancement to output a change risk score; it provides feature contribution and row-level heat mapping to achieve interpretable hints.
[0029] Data flow: Feature vector + pre-trained model + rule base → model inference → rule enhancement → SHAP value calculation → risk score (0-100) + Top-K risk factor + row-level heat map data.
[0030] Specific implementation method: 1) Model inference: Use XGBoost / LightGBM or neural network models, input feature vectors and output risk probabilities; 2) Rule enhancement: Apply expert rule base for post-processing (e.g., automatically upgrade the risk level if it involves the authentication module); 3) Interpretability: The contribution of each feature to the risk score is calculated using SHAP values, and a natural language explanation is generated; 4) Line-level heat mapping: Decompose the risk score to the line level and mark high-heat lines based on feature sources.
[0031] S5 Smart Review Router: Function Description: Combining ownership diagrams, skill profiles, repair records, and workload, assign initial / secondary reviews; dynamically require the number of reviewers and their experience level based on risk scores.
[0032] Data flow: Risk score + ownership graph + developer skill profile + current review load → candidate pool screening → load balancing → seniority matching → reviewer allocation list + review requirements.
[0033] Specific implementation method: 1) Candidate pool generation: Extract relevant module owners based on the ownership graph, and extract relevant domain experts based on Git history; 2) Skill profile matching: Maintain a developer skill tag library (security, performance, front-end, back-end) and match the skill areas involved in the changes; 3) Load balancing: Query the number of PRs awaiting review and the average review cycle for each reviewer to avoid overload distribution; 4) Dynamic review requirements: Low risk (0-30) requires 1 reviewer; Medium risk (31-70) requires 2 reviewers, with at least 1 senior reviewer; High risk (71-100) requires 3 reviewers, with at least 1 senior / architect reviewer, and a second review is required.
[0034] S6 Visual Review and Testing Recommendations: Function Description: Displays file / function / line-level popularity, key risk factors, affected services / interfaces, and a list of test suggestions on the review interface; generates test case templates for high-risk logic with one click. (Refer to...) Figure 2 .
[0035] Data flow: Risk score + row-level heatmap + impact sub-map + test related data → data aggregation → visualization rendering → review interface component data + test case template.
[0036] Specific implementation method: 1) Popularity visualization: At the file level, risk popularity is represented by varying shades of color; at the function level, high-risk functions are marked in the code overview panel; at the line level, a gradient background color is displayed in the Diff view. 2) Risk Factor Display: The sidebar displays the Top Risk Factor cards; clicking on them will take you to the corresponding code location. 3) Impact Scope Display: Visually display the affected service topology and API call chain; 4) Test suggestion generation: Generate test case templates (test scenarios, expected results, boundary conditions) based on changed code and risk patterns, and integrate AI code generation capabilities to generate unit test frameworks with one click.
[0037] S7 Strategy Verification and Merging Gate Control: Function Description: Integrates with CI to intercept the merging of policies that are not met; high-risk cases require re-evaluation or gray-scale verification.
[0038] Data flow: Risk score + review status + CI build result + grayscale verification result → policy rule matching → status check → merge license / blocking result + explanation of blocking reason.
[0039] Specific implementation method: 1) CI Integration: As a stage of the CI Pipeline, it performs strategy checks before code merging; 2) Policy and Rule Engine: Basic policies (must pass CI build, code review, and resolution discussion); Risk policies (high-risk policies require additional review and gray-scale verification); Compliance policies (security-related code requires approval from the security team). 3) Gray-scale verification integration: High-risk changes automatically trigger pre-release environment deployment, monitor key indicators (error rate, latency, resource usage), and allow the deployment if the indicators are normal, and block and alert if abnormal. 4) Merge gate control: Call the Git platform API to set branch protection rules, and prohibit merge operations if the policy is not met.
[0040] Based on the above technical solution, the present invention can be further optimized and improved: 1. Introduce a large model for intent Function Description: Introduces a large model for intent-code consistency judgment, error-prone pattern detection, and test strategy recommendation.
[0041] Data flow: Change intent text + code Diff → Large model API call → Semantic analysis results (consistency score, list of error-prone patterns, test strategy suggestions) → Feature vector enhancement / test template generation.
[0042] Specific implementation method: 1) Intent-Code Consistency Assessment: Input the PR / MR description and the change code into the large model simultaneously, and output a semantic consistency score (0-1) and an explanation of the inconsistencies; 2) Error-prone pattern detection: Construct error-prone pattern prompt templates to guide large models to identify common defect patterns such as null pointer exceptions, resource leaks, concurrency race conditions, and SQL injection. 3) Test strategy recommendation: Based on the changed code and risk characteristics, generate targeted test scenarios, boundary conditions, and abnormal test case suggestions through a large model; 4) Model Deployment: Supports access to cloud-based large model APIs or private deployment of open-source models (such as CodeLlama and DeepSeek-Coder), ensuring code and data security.
[0043] Expected results: Semantic risk identification accuracy will improve by 15%-25%, and the adoption rate of test suggestions will increase by approximately 30%.
[0044] 2. Enhance dynamic link analysis capabilities Function Description: Enhances dynamic link analysis (real-time sampling of call chains and traffic replay) to improve the accuracy of impact analysis.
[0045] Data flow: APM call chain data + traffic sampling logs → link parsing → real-time call topology → impact range calculation → dynamic risk feature update.
[0046] Specific implementation method: 1) Real-time call chain sampling: Integrate with APM systems (such as Jaeger, Zipkin) to collect call chain data in the production environment in real time and build a dynamic call topology; 2) Traffic replay: Record and replay production traffic in the pre-release environment to verify the impact of changes on real requests and identify potential performance degradation; 3) Impact Scope Calculation: Combining the static call graph and dynamic call chain, calculate the actual impact scope of the changed code and filter out dead code paths that have not been executed; 4) Risk feature update: Based on dynamic link data, update the dynamic risk features such as critical path traffic and diffusion to improve the accuracy of risk assessment.
[0047] Expected results: Improve the accuracy of impact range analysis by 20%-30% and reduce invalid alarms by approximately 25%.
[0048] 3. Enhanced review and control of sensitive segments Function Description: Enables stricter review and control policy templates for sensitive segments such as security and finance.
[0049] Data flow: Code change → Sensitive segment identification → Policy template matching → Strengthened review requirements + Strengthened gate control conditions → Merging decision.
[0050] Specific implementation method: 1) Sensitive code segment identification: A predefined library of sensitive code patterns (such as payment logic, permission verification, data encryption, and financial calculation) is used to identify sensitive code segments through AST analysis and regular expression matching; 2) Policy Template Configuration: Configure differentiated policy templates for different sensitivity levels, such as: Security level: Requires mandatory approval from the security team + passing penetration testing + gray-scale verification; Finance level: Requires confirmation from the finance team + passing the reconciliation test + double review; Core business level: Requires architect approval + full regression testing + canary release; 3) Enhanced gate control enforcement: During the S7 policy verification phase, additional requirements for sensitive segment policy templates are added; if these requirements are not met, forced blocking and merging are implemented. 4) Audit traceability: Record the complete review chain and approval records of sensitive code changes to support compliance auditing.
[0051] Expected results: The online incident rate related to sensitive code will decrease by 40%-60%, and the efficiency of compliance audits will improve by approximately 50%.
[0052] The following is an example of the present invention: changing payment routing logic.
[0053] The system detects "critical path + configuration change + historical high defect" and the risk score increases significantly; the interface marks the row-level heat of rule matching / anomaly handling branches and generates boundary test suggestions; experts in the routing payment field are the first to evaluate, and CI mandatory contract testing and canary testing are conducted; defects can only be merged after they are found and fixed during the review stage.
[0054] It should be noted that, for the sake of simplicity, the method embodiments are all described as a series of actions. However, those skilled in the art should understand that the embodiments of the present invention are not limited to the described order of actions, because according to the embodiments of the present invention, some steps can be performed in other orders or simultaneously. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are preferred embodiments, and the actions involved are not necessarily essential to the embodiments of the present invention.
[0055] Reference Figure 3 This diagram illustrates the structural block of a change risk visualization and intelligent review system for code review provided in an embodiment of the present invention, which may specifically include: The data acquisition layer is used to respond to code change events, obtain metadata and difference data of code changes, and parse the change intent information based on the metadata; The code graph construction layer is used to extract affected code elements from the code repository based on the difference data, and incrementally construct code influence subgraphs related to the affected code elements based on the static analysis results. The code influence subgraphs include call graphs, dependency graphs, ownership graphs, and test association graphs. The risk feature extraction layer is used to extract risk features based on differential data and code influence subgraphs, forming a multi-dimensional feature vector. Risk features include static risk features, historical risk features, dynamic risk features, and semantic risk features. The risk assessment and interpretation layer is used to input multi-dimensional feature vectors into the risk assessment model, calculate the risk assessment score of code changes, and generate a line-level risk heat map for display on the code review interface based on the risk assessment score. The intelligent routing layer is used to dynamically determine the list of reviewers and the required review depth based on the risk assessment score and ownership map, and to generate corresponding review tasks. The strategy and gate control layer is used to perform verification based on risk assessment scores, review results, and predefined gate control policies before executing the code merging operation. If the verification passes, the merge is approved; if the verification fails, the merge is blocked and the reason for the block is output.
[0056] In an optional embodiment of the present invention, the data acquisition layer is configured to: In response to code change events, retrieve metadata, a list of file changes, and commit history for code merge requests or code review requests; Obtain code difference data from the file change list, parse the code abstract syntax tree of the difference data, extract the boundaries of the changed functions, classes, and modules, and obtain the changed code structure information; Based on the titles and descriptions in the submission history, a pre-trained language model is used to perform semantic encoding to obtain the semantic information of the changed text. By integrating the structural information of the changed code with the semantic information of the changed text, a vector representation of the change intent information is generated.
[0057] In an optional embodiment of the present invention, the code graph construction layer is used for: A function-level call graph is constructed based on static analysis tools, and incremental updates are performed on the functions and their call chains that have changed. Parse dependency configuration files, build module-level dependency graphs, and determine the dependent modules affected by changes; Parse ownership configuration files and code commit history to establish a mapping between files and developers, forming an ownership graph to determine the code owner of the changed files; By using code coverage reports and test case naming conventions, the relationship between code changes and test cases is established, forming a test relationship graph; Parse the service interface definition file, annotate the interface contracts and traffic routing mappings between services, and incorporate the mapping relationships into the code influence subgraph.
[0058] In an optional embodiment of the present invention, the risk feature extraction layer is used for: Calculate the cyclomatic complexity, cognitive complexity, and nesting depth of the modified code, identify exception handling paths and sensitive operation patterns, and form static risk characteristics; Query historical defect records, calculate the historical defect density of changed files or modules, analyze code rollback records to count rollback frequency, and calculate the time interval since the last modification to form historical risk characteristics; The code coverage report is analyzed to identify uncovered lines of code, function call frequency and response latency are obtained based on application performance management data, and alarm records in the pre-release environment are queried to form dynamic risk characteristics; Calculate the semantic similarity between the change intent information and the actual code change, and use a pre-trained model to identify common error-prone patterns in the code to form semantic risk features; Static risk features, historical risk features, dynamic risk features, and semantic risk features are combined into a multidimensional feature vector.
[0059] In an optional embodiment of the present invention, the risk assessment and interpretation layer is used for: The multidimensional feature vector is input into the trained machine learning model, which outputs the initial risk probability. The initial risk probability is adjusted using preset expert rules to obtain a risk assessment score; The contribution of each risk feature in the multidimensional feature vector to the risk assessment score is calculated using the interpretability analysis method, and the corresponding natural language explanation is generated. The risk assessment score is broken down to the line level, and the source of each risk characteristic is traced to generate a line-level risk heat map for display in the code review interface.
[0060] In an optional embodiment of the present invention, the intelligent routing layer is reviewed for: Based on the ownership graph and code commit history, candidate reviewers related to code changes are selected from the developer pool; Based on the skill areas involved in the code change, match the skill profiles of the candidate reviewers, query the number of tasks to be reviewed and the average review cycle for each candidate reviewer, and perform load balancing calculations to determine the list of reviewers. The required depth of review is dynamically determined based on the risk level range in which the risk score falls. The required depth of review includes at least the number of reviewers required, their qualification level, and whether a re-review is required.
[0061] In an optional embodiment of the present invention, the strategy and gate control layer is used for: Load the basic strategy, risk strategy, and compliance strategy, and verify them based on the risk assessment score and review results; wherein the risk strategy includes triggering additional re-evaluation and gray-scale verification based on the risk score. When the risk assessment score is higher than the preset threshold, the pre-release environment deployment is automatically triggered, and key operating indicators are monitored. If the key operating indicators are normal, the gray-scale verification is deemed to have passed. If the key operating indicators are abnormal, an alarm is generated and the merging is blocked.
[0062] In one optional embodiment of the present invention The risk feature extraction layer is also used to input the change intent information and the difference data into the large language model, and the large language model outputs the intent-code consistency score and inconsistency point description, and incorporates the consistency score as an additional semantic risk feature into the multidimensional feature vector; And / or, The system also includes a visualization and interaction layer, used for: The large language model generates test strategy suggestions based on the difference data and the risk assessment score, and generates unit test code frameworks based on the test strategy suggestions; the test strategy suggestions include test scenarios, boundary conditions and abnormal test cases.
[0063] In an optional embodiment of the present invention, the strategy and gate control layer is further configured to: The discrepancy data is subjected to sensitive code fragment identification; the sensitive code fragments include at least code patterns related to payment logic, permission verification, data encryption, and financial calculation. When a sensitive code segment is identified, a corresponding enhanced gate control template is loaded according to the type and level of the sensitive code segment; the enhanced gate control template includes at least one of the following: mandatory approval by a designated security team or finance team, requirement for double review, mandatory passage of penetration testing or reconciliation testing, and mandatory execution of canary release; The gate control conditions in the enhanced gate control template are superimposed onto the predefined gate control strategy, and verification is performed based on the superimposed gate control strategy.
[0064] The functionalities of the change risk visualization and intelligent review system for code review are described below: Data Acquisition Layer: Collects PR / MR, Commit, Diff, Issue, Build / Test, Coverage, Static Analysis, APM Alerts, Service Contracts, Ownership and Historical Review Records; parses the commit intent text.
[0065] Code graph construction layer: Builds call graph, dependency graph, ownership graph, and test association graph; incremental update change impact subgraph, and marks cross-service interface contracts and traffic routing mapping.
[0066] Risk feature extraction layer: extracts static / historical / dynamic / semantic features to generate a unified feature vector.
[0067] Risk assessment and interpretation layer: RiskEngine outputs risk scores and factor interpretations, and row-level heat mapping.
[0068] Review Intelligent Routing Layer: Combining profiles and historical repair records, dynamically assign reviewers and review depth requirements.
[0069] Visualization and Interaction Layer: The interface presents risk popularity, factor explanations, scope of impact, and testing suggestions; it also supports one-click generation of test templates.
[0070] Policy and gate control layer: The policy engine performs merged gate control based on risk score and necessary verification (coverage, contract, grayscale).
[0071] As the system implementation is basically similar to the method implementation, it is described in a relatively simple way. For relevant details, please refer to the description of the method implementation.
[0072] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.
[0073] The various embodiments in this specification are described in a related manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the system embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions of the method embodiments.
[0074] The above description is merely a preferred embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention are included within the scope of protection of the present invention.
Claims
1. A method for visualizing and intelligently reviewing change risks in code review, characterized in that: The method includes: In response to code change events, obtain the metadata and difference data of the code change, and parse the change intent information based on the metadata; Based on the discrepancy data, the affected code elements are extracted from the code repository, and a code impact subgraph related to the affected code elements is incrementally constructed based on the static analysis results. The code impact subgraph includes a call graph, dependency graph, ownership graph, and test association graph. Based on the differential data and code impact subgraph, risk features are extracted to form a multi-dimensional feature vector. The risk features include static risk features, historical risk features, dynamic risk features, and semantic risk features. The multidimensional feature vector is input into the risk assessment model to calculate the risk assessment score of the code change, and a line-level risk heat map is generated based on the risk assessment score for display on the code review interface. Based on the risk assessment score and ownership diagram, the list of reviewers and the required depth of review are dynamically determined, and corresponding review tasks are generated. Before performing the code merging operation, the code is validated based on the risk assessment score, review results, and predefined gate control policies. If the validation passes, the merge is approved; if the validation fails, the merge is blocked and the reason for the block is output.
2. The method according to claim 1, characterized in that, In response to code change events, the system retrieves metadata and difference data related to the code changes, and parses the change intent information based on the metadata, including: In response to code change events, retrieve metadata, a list of file changes, and commit history for code merge requests or code review requests; Obtain code difference data from the file change list, parse the code abstract syntax tree of the difference data, extract the boundaries of the changed functions, classes, and modules, and obtain the changed code structure information; Based on the titles and descriptions in the submission history, a pre-trained language model is used to perform semantic encoding to obtain the semantic information of the changed text. By integrating the structural information of the changed code with the semantic information of the changed text, a vector representation of the change intent information is generated.
3. The method according to claim 2, characterized in that, Based on the discrepancy data, affected code elements are extracted from the code repository, and a code impact subgraph related to the affected code elements is incrementally constructed based on the static analysis results, including: A function-level call graph is constructed based on static analysis tools, and incremental updates are performed on the functions and their call chains that have changed. Parse dependency configuration files, build module-level dependency graphs, and determine the dependent modules affected by changes; Parse ownership configuration files and code commit history to establish a mapping between files and developers, forming an ownership graph to determine the code owner of the changed files; By using code coverage reports and test case naming conventions, the relationship between code changes and test cases is established, forming a test relationship graph; Parse the service interface definition file, annotate the interface contracts and traffic routing mappings between services, and incorporate the mapping relationships into the code influence subgraph.
4. The method according to claim 3, characterized in that, Based on the differential data and code impact subgraph, risk features are extracted to form a multi-dimensional feature vector, including: Calculate the cyclomatic complexity, cognitive complexity, and nesting depth of the modified code, identify exception handling paths and sensitive operation patterns, and form static risk characteristics; Query historical defect records, calculate the historical defect density of changed files or modules, analyze code rollback records to count rollback frequency, and calculate the time interval since the last modification to form historical risk characteristics; The code coverage report is analyzed to identify uncovered lines of code, function call frequency and response latency are obtained based on application performance management data, and alarm records in the pre-release environment are queried to form dynamic risk characteristics; Calculate the semantic similarity between the change intent information and the actual code change, and use a pre-trained model to identify common error-prone patterns in the code to form semantic risk features; Static risk features, historical risk features, dynamic risk features, and semantic risk features are combined into a multidimensional feature vector.
5. The method according to claim 1, characterized in that, The multidimensional feature vector is input into the risk assessment model to calculate the risk assessment score for code changes. Based on the risk assessment score, a line-level risk heatmap is generated for display on the code review interface, including: The multidimensional feature vector is input into a trained machine learning model, which outputs the initial risk probability. The initial risk probability is adjusted using preset expert rules to obtain a risk assessment score; The contribution of each risk feature in the multidimensional feature vector to the risk assessment score is calculated using the interpretability analysis method, and the corresponding natural language explanation is generated. The risk assessment score is broken down to the line level, and the source of each risk characteristic is traced to generate a line-level risk heat map for display in the code review interface.
6. The method according to claim 2, characterized in that, Based on the risk assessment score and ownership diagram, the list of reviewers and the required depth of review are dynamically determined, including: Based on the ownership graph and code commit history, candidate reviewers related to code changes are selected from the developer pool; Based on the skill areas involved in the code change, match the skill profiles of the candidate reviewers, query the number of tasks to be reviewed and the average review cycle for each candidate reviewer, and perform load balancing calculations to determine the list of reviewers. The required depth of review is dynamically determined based on the risk level range in which the risk score falls. The required depth of review includes at least the number of reviewers required, their qualification level, and whether a re-review is required.
7. The method according to claim 1, characterized in that, Before performing the code merging operation, a verification process is conducted based on the risk assessment score, review results, and predefined gate control policies. If the verification passes, the merge is approved; if the verification fails, the merge is blocked, and the reason for the block is output, including: Load the basic strategy, risk strategy, and compliance strategy, and verify them based on the risk assessment score and review results; wherein the risk strategy includes triggering additional re-evaluation and gray-scale verification based on the risk score. When the risk assessment score is higher than the preset threshold, the pre-release environment deployment is automatically triggered, and key operating indicators are monitored. If the key operating indicators are normal, the gray-scale verification is deemed to have passed. If the key operating indicators are abnormal, an alarm is generated and the merging is blocked.
8. The method according to claim 1, characterized in that, The method further includes: The change intent information and the difference data are input into the large language model, which outputs an intent-code consistency score and an explanation of inconsistencies. The consistency score is then incorporated into the multidimensional feature vector as an additional semantic risk feature. And / or, The large language model generates test strategy suggestions based on the difference data and the risk assessment score, and generates unit test code frameworks based on the test strategy suggestions; the test strategy suggestions include test scenarios, boundary conditions and abnormal test cases.
9. The method according to claim 1, characterized in that, Before performing code merging, and prior to the verification steps based on risk assessment scores, review results, and predefined gate control policies, the following steps are also included: The discrepancy data is subjected to sensitive code fragment identification; the sensitive code fragments include at least code patterns related to payment logic, permission verification, data encryption, and financial calculation. When a sensitive code segment is identified, a corresponding enhanced gate control template is loaded according to the type and level of the sensitive code segment; the enhanced gate control template includes at least one of the following: mandatory approval by a designated security team or finance team, requirement for double review, mandatory passage of penetration testing or reconciliation testing, and mandatory execution of canary release; The gate control conditions in the enhanced gate control template are superimposed onto the predefined gate control strategy, and verification is performed based on the superimposed gate control strategy.
10. A change risk visualization and intelligent review system for code review, characterized in that: The system includes: The data acquisition layer is used to respond to code change events, obtain metadata and difference data of code changes, and parse the change intent information based on the metadata; The code graph construction layer is used to extract affected code elements from the code repository based on the difference data, and incrementally construct code influence subgraphs related to the affected code elements based on the static analysis results. The code influence subgraphs include call graphs, dependency graphs, ownership graphs, and test association graphs. The risk feature extraction layer is used to extract risk features based on differential data and code influence subgraphs, forming a multi-dimensional feature vector. Risk features include static risk features, historical risk features, dynamic risk features, and semantic risk features. The risk assessment and interpretation layer is used to input multi-dimensional feature vectors into the risk assessment model, calculate the risk assessment score of code changes, and generate a line-level risk heat map for display on the code review interface based on the risk assessment score. The intelligent routing layer is used to dynamically determine the list of reviewers and the required review depth based on the risk assessment score and ownership map, and to generate corresponding review tasks. The strategy and gate control layer is used to perform verification based on risk assessment scores, review results, and predefined gate control policies before executing the code merging operation. If the verification passes, the merge is approved; if the verification fails, the merge is blocked and the reason for the block is output.