OneGraph: local Gemma 4 explains PR risk from a real dependency graph

What they built

An LLM code reviewer that reads a diff in isolation can't see what else in the repository depends on the changed lines. OneGraph, built for Hacktoberfest Hack Day Pune, closes that gap by pairing Graphify, a tree-sitter based dependency graph extractor, with Gemma 4.

The result is wired into PR-Agent as a /graph_risk command that posts a comment on any pull request with a risk level, a list of affected dependents and a link to the full interactive graph. The rule throughout is that code owns the facts and Gemma owns the words.

Setup

• Graphify for graph extraction and community labeling, with no LLM call
• Gemma 4 served locally through Ollama as gemma4:12b-it-q4_K_M
• PR-Agent with a new graph_risk tool registered in its command map
• Code at github.com/CodersAcademy006/onegraph

How it works

1. graphify extract --code-only runs tree-sitter over the repo and records every call, import and containment edge, deterministically.
2. graphify label runs community detection and names each cluster.
3. The risk level is arithmetic from a real count of a changed function's call sites, not the model's opinion.
4. Gemma reads the graph traversal result rather than raw source and writes only the plain-English analysis, which is dropped into a template where every number comes from graph.json.

Results & numbers

• One measured local /graph_risk run took 132.8 seconds of wall time, with 2,438 input tokens and 1,658 output tokens, at no API cost.
• Graphify handled four public repos end to end, up to 65,361 nodes and 247,294 edges for supabase/supabase.
• In an A/B test, both the graph-grounded and embedding-RAG answers were 100% citation-accurate; the difference was that the graph version found more of the relevant call sites.

Gotchas

• Passing a relative path into the subprocess wrapper that changes cwd made the graph argument point nowhere and produced a bare CalledProcessError; the fix was calling .resolve() at every call site.
• Grounding didn't reduce hallucinated citations in his test, because the baseline had none; its benefit was coverage.

“code owns the facts, Gemma owns the words.”— CodersAcademy006

Do it yourself

1. Install Ollama and pull a Gemma 4 model that fits your GPU.
2. Build a dependency graph of your repo with a tree-sitter based tool such as Graphify.
3. For each changed function in a PR, count its real dependents from the graph and set the risk level from that count.
4. Give the local model only the traversal result and ask it to describe the impact in plain English.
5. Post the result as a PR comment, for example by registering a command in PR-Agent.