Cross-repository dependency mapping, blast radius, and change-impact analysis for GitLab and GitHub orgs — field notes from building Riftmap.
Nx named the synthetic monorepo and built a genuine cross-repo package-and-API graph. The phrase hides a second problem it does not map today: which repositories a Terraform, Docker, or Helm change actually breaks.
I parsed four public Terraform estates. Versioning style is an org-level habit, not a per-module choice — and it decides whether a bulk migration lands cleanly.
Port's CEO called Backstage dead, then GitLab shipped Orbit. Is Orbit a developer portal? No, it ships no catalog — and the catalog wars miss the question none of them answers.
Parsed cross-repo dependency edges across 1,297 repos in nine public platform orgs. One in four repos is load-bearing for a sibling. Top hub: 188 dependents.
Blast radius is really two measurements — the code radius your tests catch, and the artifact radius that crosses repos. In one org, 147 repos hit one module.
A Riftmap scan of 242 Cloud Posse repos found 147 declaring terraform-null-label, 133 on context.tf line 24, plus what grep, symbol graphs, and catalogs miss.
Parsed vs inferred is a two-horse race that hides a third runner: registered. How declared, inferred, and registered dependency tools each know an edge exists.
A pull request to a repository that a hundred others build on should not merge with one approval from a phone. A CI gate that routes review by measured downstream exposure — two HTTP calls, about forty lines, GitLab CI or GitHub Actions, no cloud credentials in the pipeline.
Yes — but only if a dependency graph exists for it to query. At least three different graphs are being sold under one phrase, and each is blind to a different kind of change. Here's what each one genuinely sees, walked end to end on a real public org.
How to tune Cursor's codebase index for a large monorepo or a fifty-repo workspace, and the one question no amount of tuning makes it answer.
Both agents can be handed more than one repo — but Claude Code only sees your clone and Cursor's index answers similarity. How to wire in the dependency graph.
Coding agents got cross-repo access this year. They still can't see the blast radius of a base-image bump — because that edge was never a function call, and it lives in a repo they never cloned.
You own a Kustomize base. Which overlays across your org build on it, at which ref — and what breaks when you change it? Why grep can't tell you, and what can.
I scanned Prometheus and Cloud Posse and counted every cross-repo edge. Infrastructure runs from 38% to 99.75% of the coupling. Code symbols: zero.
A shared CI change is not a release. It is two deployments at once: instant to the pipelines tracking your branch, silent to the ones pinned to a tag. You hold the roster for neither.
Ansible has no lockfile and no reverse lookup: change a shared role and nothing says who breaks. Why finding every consumer is harder than grep.
Overmind reads your live AWS, GCP and Kubernetes state to tell you whether a Terraform apply is safe. Riftmap parses source to tell you which other repositories consume what you are changing. Both call it "blast radius". They are not the same radius.
A deprecation warning only reaches consumers who recompile, and the repos that pinned the old version go quiet. Deprecating an internal library is a census problem.
A senior leaves and the code stays readable. What walks out is the cross-repo dependency map they held in their head — the part your bus factor, measured from commits, never counted.
You maintain an internal Python package and a breaking change is coming. Which repos depend on it, at which version — and why pip, PyPI and your private index all answer the wrong question.
A scanner finds the vulnerable base image or package — not the repos you patch. Why CVE remediation is a cross-repo source problem, shown in Docker and npm.
Tribal knowledge is two different things wearing one name. The half everyone panics about losing was declared in your Terraform, your Dockerfiles, and your CI config the whole time.
You maintain an internal npm package and a breaking change is coming. Which repos depend on it, at which version — and why npm answers this for public packages but not for your scoped ones.
GitLab Orbit is an excellent symbol-and-SDLC graph. It's also the clearest illustration yet of the one layer that kind of graph can't reach: the infrastructure dependencies running between your repositories.
You maintain a shared GitLab CI template. Which projects include it, at which ref — and what breaks when you merge? Why GitLab can't tell you, and what can.
The Backstage worth-it debate is always about cost — FTEs, months, TCO. Spotify's own head of Backstage engineering says that's not where it dies.
Every "Backstage alternatives" roundup lists the same five portals. None of them asks the question that decides which alternative is right: what job sent you looking in the first place?
Three working ways to get cross-repo context into GitHub Copilot right now — multi-root workspaces, Copilot Spaces, and MCP for the cloud agent — and the one question all three leave you to answer by hand.
Monorepo vs polyrepo is argued as a code-location debate. The real variable is whether "what depends on this" is queryable — and infrastructure never got a vote.
The CRA's 24-hour reporting clock asks which products ship an exploited component. Your SBOM lists what is inside one artifact. Those are different questions, and the gap between them is a cross-repo IaC dependency graph.
The multi-repo agent race is solving repository access. But access is plumbing — the cross-repo dependency graph is the part nobody upstream is parsing.
An enterprise context engine makes your agent generate better code. A parsed dependency graph is the thing you gate a deploy on. Two jobs, two kinds of machinery, and why a confidence score is the wrong guarantee for the second one.
Why Port's Blueprints can model the catalog you describe but not the dependency graph your repos already declare — and why modeled graphs and parsed graphs are different categories.
Why Sourcegraph's symbol graph can't tell you who consumes your Helm chart at v3.2.0 — and why symbol graphs and artifact graphs are different categories.
The vocabulary moved into vendor docs in sixty days. The parser-derived cross-repo dependency graph it describes hasn't shipped in any AI coding product.
I scanned all 208 kubernetes-sigs repos with Riftmap. Here's the cross-repo dependency graph, including the 153 repos that import sigs.k8s.io/yaml.
Three teams shipped the same diagnosis in two weeks: AI coding agents need cross-repo context. Two built the dependency graph substrate. One built around it.
A close read of Meta's April 2026 tribal knowledge engine, the academic paper they cited, and the architectural argument hidden inside both.
Backstage and the developer-portal category solve a real problem. The reason platform teams quietly abandon them is something different, and it points at the shape of what actually works.
I scanned all 56 repos in the Prometheus org with Riftmap. Here's the cross-repo dependency graph, including the 25 repos that import client_golang.
A practitioner's guide to calculating change failure rate for your team without a vendor platform — the DORA formula, the SQL, and the one cut nobody is making yet: AI-assisted PRs vs human-authored.
AI coding tools optimise for local correctness, but production breaks at the edges of the cross-repo dependency graph they can't see. A look at the 2025–2026 data — Cortex, DORA, CodeRabbit, and Amazon's own high-blast-radius memo — and what to put between the agent and main.
You maintain an internal Go module. A breaking API change is coming. Which repos across your org import it — and at which version? Here's why the answer is harder than it should be.
You maintain a shared Helm chart. A breaking value rename or API version bump is coming. Which deployments across your org depend on it — and at which version? Here's why the answer is harder than it should be.
You maintain a shared GitHub Actions workflow. You need to rename an input, drop a step, or change a required secret. Which repos across your org call it — and at which ref? Here's why the answer is harder than it should be.
When you need to make a breaking change to a shared Terraform module, which repos are affected? In one public org, 149 of 244 repositories consume a single module. Here is why the answer is harder than it should be.
When a CVE hits your Docker base image, which repos are affected? Here's why the answer is harder than it should be, and what a real solution requires.
An honest survey of the infrastructure dependency tooling landscape in 2026 — what Backstage, Renovate, HCP Terraform Explorer, Nx, Wiz, and DIY scripts each solve, where they fall short, and the gap that none of them fill.
A technical deep-dive into auto-discovering cross-repo dependencies across Terraform, Docker, CI pipelines, Python, Go, npm, Ansible, Helm, Kubernetes, and Kustomize — and why each ecosystem fights back.
Why every platform team eventually builds the same brittle script, and why it keeps breaking. A deep look at cross-repo dependency visibility — the infrastructure problem hiding in plain sight.
