Thinking about infrastructure dependencies
Articles on platform engineering, multi-repo visibility, blast radius analysis, and the patterns that help teams ship safely.
Find Every Consumer — The Series
A practical series covering how to track down every repo in your org that depends on a shared Terraform module, Docker base image, Helm chart, Go module, or GitHub Actions workflow — and why grep isn't enough.
What an org actually depends on — The Series
Scans of well-known open-source orgs rendered as cross-repo dependency graphs — what's central, what's a leaf, where the receipts live, and what the scanner missed.
-
Symbol graphs and artifact graphs: why Sourcegraph stops where infrastructure starts
Why Sourcegraph's symbol graph can't tell you who consumes your Helm chart at v3.2.0 — and why symbol graphs and artifact graphs are different categories.
-
Cross-repo context is in product docs. The graph is not.
The vocabulary moved into vendor docs in sixty days. The parser-derived cross-repo dependency graph it describes hasn't shipped in any AI coding product.
-
What 208 kubernetes-sigs repos actually depend on
I scanned all 208 kubernetes-sigs repos with Riftmap. Here's the cross-repo dependency graph, including the 153 repos that import sigs.k8s.io/yaml.
-
You don't need a virtual monorepo. You need a graph.
Two patterns for AI coding agent context across repos. One scales by hand, one by construction.
-
AI coding agents need cross-repo context. The teams running them at scale are already building it themselves.
Three teams shipped the same diagnosis in two weeks: AI coding agents need cross-repo context. Two built the dependency graph substrate. One built around it.
-
Meta needed 50+ AI agents to map their tribal knowledge. The most durable piece of their stack is the part you can build today.
A close read of Meta's April 2026 tribal knowledge engine, the academic paper they cited, and the architectural argument hidden inside both.
-
The catalog maintenance trap: why service catalogs go stale
Backstage and the developer-portal category solve a real problem. The reason platform teams quietly abandon them is something different, and it points at the shape of what actually works.
-
What 56 Prometheus repos actually depend on
I scanned all 56 repos in the Prometheus org with Riftmap. Here's the cross-repo dependency graph, including the 25 repos that import client_golang.
-
Change failure rate is up 30% — here's how to measure yours in an afternoon
A practitioner's guide to calculating change failure rate for your team without a vendor platform — the DORA formula, the SQL, and the one cut nobody is making yet: AI-assisted PRs vs human-authored.
-
AI Doesn't Understand Blast Radius: Why Change Failure Rates Are Up 30%
AI coding tools optimise for local correctness, but production breaks at the edges of the cross-repo dependency graph they can't see. A look at the 2025–2026 data — Cortex, DORA, CodeRabbit, and Amazon's own high-blast-radius memo — and what to put between the agent and main.
-
How to Find Every Consumer of Your Go Module
You maintain an internal Go module. A breaking API change is coming. Which repos across your org import it — and at which version? Here's why the answer is harder than it should be.
-
How to Find Every Consumer of Your Helm Chart
You maintain a shared Helm chart. A breaking value rename or API version bump is coming. Which deployments across your org depend on it — and at which version? Here's why the answer is harder than it should be.
-
How to Find Every Consumer of Your Reusable GitHub Actions Workflow
You maintain a shared GitHub Actions workflow. You need to rename an input, drop a step, or change a required secret. Which repos across your org call it — and at which ref? Here's why the answer is harder than it should be.
-
How to Find Every Consumer of Your Terraform Module
When you need to make a breaking change to a shared Terraform module, which repos are affected? Here's why the answer is harder than it should be.
-
How to Find Every Consumer of Your Docker Base Image
When a CVE hits your Docker base image, which repos are affected? Here's why the answer is harder than it should be, and what a real solution requires.
-
The State of Infrastructure Dependency Tooling in 2026
An honest survey of the infrastructure dependency tooling landscape in 2026 — what Backstage, Renovate, HCP Terraform Explorer, Nx, Wiz, and DIY scripts each solve, where they fall short, and the gap that none of them fill.
-
Auto-Discovering Infrastructure Dependencies Across 10 Ecosystems
A technical deep-dive into auto-discovering cross-repo dependencies across Terraform, Docker, CI pipelines, Python, Go, npm, Ansible, Helm, Kubernetes, and Kustomize — and why each ecosystem fights back.
-
The Infrastructure Dependency Problem No One Has Solved
Why every platform team eventually builds the same brittle script, and why it keeps breaking. A deep look at cross-repo dependency visibility — the infrastructure problem hiding in plain sight.