Change risk and PR review
Turn a diff into a review plan before it reaches merge.
Repowise scores the shape of a commit, then joins the changed files to dependency reach, co-change history, tests, ownership, and decisions. Reviewers get a priority and the evidence that should change what they inspect.
Deterministic scoring. Structural impact and historical correlation stay labeled as different evidence.
Install the PR Bot- change-risk score
- 0–10
- review directives
- 4
- LLM calls
- 0
- analysis scope
- Any range
One deterministic score for a commit or base..head range.
may_break, missing_cochanges, missing_tests, and governance_risk.
The score and PR directive path are deterministic.
A single commit, feature branch, pull request, or release range.
Real review evidence
One comment shows the risk, the affected surface, and what the reviewer should do next.
The PR Bot carries the same change-risk result into the workflow where it matters. It comments only when the analysis finds something worth checking, keeping the score beside the changed files, missing evidence, and concrete review direction.
The product capture shows a real Repowise PR Bot comment. Green pull requests remain silent.
How the index produces it
The diff supplies the change. The index supplies the consequences.
Change shape and repository context are evaluated together, then returned as separate evidence types so reviewers can distinguish measured risk, structural reach, and historical correlation.
- 01 / Score
Measure the change shape
Size, entropy, edit dispersion, and the history of touched files produce the repo-relative review priority. - 02 / Expand
Join repository evidence
The graph contributes dependents, git contributes co-change partners and ownership, coverage contributes measured test links, and decisions contribute governance context. - 03 / Direct
Return the review checklist
PR mode leads with the files and evidence most likely to change the review: impact candidates, omitted partners, test gaps, and governance risk.
Honest limitations
Reachability is not proof of breakage.
Dependents are structural candidates, not a runtime guarantee. Co-change partners are historical correlation, not a dependency. Coverage-measured tests and inferred graph candidates remain distinct, and an empty test recommendation means unknown when coverage analysis is unavailable.
Questions, answered
The details behind the claim.
How is change risk scored?
Every commit or base..head range gets a single 0 to 10 defect-risk score computed from the shape of the diff using Kamei-style just-in-time metrics: the size of the change, its entropy, how scattered the edits are across files, and the history of the files being touched. The result is a repo-relative review-priority band, so a 7 on one codebase means the same thing as a 7 on another.
Does it use an LLM?
No. Scoring is fully deterministic. It is computed from the diff and the dependency graph with Kamei-style just-in-time metrics, no model in the loop. The same diff produces the same score every time, with no drift, no token bills, and no prompt-injection surface.
What are the PR directives?
In PR mode the score comes with a directive block that tells reviewers exactly what to check: may_break flags dependents that the change is likely to affect, missing_cochanges flags files that usually change together but were left out, missing_tests flags risky code with no accompanying test changes, and governance_risk flags edits to files governed by an architectural decision or to ungoverned hotspots.
How does change risk relate to the Repowise PR Bot?
The same deterministic signal powers the Repowise PR Bot. The bot posts one comment per pull request, only when there is something worth saying. A green PR gets no comment. There are zero LLM calls in the path, so the same PR twice produces the exact same comment.
Is it free?
Yes for public and open-source repositories. The Repowise PR Bot is a free GitHub App for public repos, and the change-risk scoring ships in the open-source repowise package under AGPL-3.0. Private-repo PR comments require Repowise Pro.
What is blast radius?
Blast radius is the full set of dependents of a change: every file, module, and symbol that could be affected by what you touched, derived from the real dependency graph rather than guessed. repowise uses the same graph to suggest the right reviewers for the change.
Can I run it on a commit, not just a PR?
Yes. Change risk scores any commit or any base..head range, not only pull requests. Run it locally over MCP or the CLI on a single commit, on a feature branch before you open a PR, or on a range to triage what changed since a release.
How is this different from an LLM review bot?
LLM review bots are non-deterministic, noisy, billed per pull request, and carry a prompt-injection surface. repowise scores risk deterministically from the diff and the dependency graph, returns the same score for the same change every time, and only speaks when the signal warrants it.
Last reviewed: September 2026
Put the review evidence on the pull request.
Install the Repowise PR Bot for public repositories and surface the deterministic score only when there is something worth checking.