Live dependency graph
The Cloud Posse org, as a dependency graph.
242 repos, scanned 7 July 2026. One module — terraform-null-label — declared by 147 of them at the 0.8 confidence floor. That is 61% of the org, one breaking change away. Click it to see the blast radius.
The same scan, as a table
The most depended-on repositories in cloudposse
Riftmap scanned the
cloudposse
GitHub organisation between 7 July and 10 July 2026 and parsed the dependency edges its manifests
declare — go.mod requires, Dockerfile FROM lines, Terraform
source blocks, Helm chart dependencies, GitHub Actions uses:
references. Across 241 active repositories (1 archived, excluded), 299 distinct repo-to-repo dependencies survived the confidence floor,
and 61 repositories (25.3%) turned out to be a
dependency of at least one sibling — an edge that is invisible from inside the repository you
are changing. Same method, same bar, and directly comparable to the nine-org scan, where the pooled
figure across 1,297 repositories was 24.7%.
Reading the two columns.Direct dependents counts distinct active sibling repositories at or above Riftmap's 0.8 confidence floor — the same bar impact mode applies, and the one every figure in the nine-org scan is computed on. All declared references holds that scope and drops only the floor, so the gap between the columns isolates exactly one thing: how much of this org's coupling is declared outright versus inferred. Across the org the floor discards 79 of 378 repo-to-repo pairs. Multiple manifests pointing at the same repository count once. The graph above additionally draws archived repositories, so a node there can show more arrows than either column reports.
What the floor throws away here. A repository can look larger in the graph than
it reads in this table, and these are the ones where that gap is worth naming: cloudposse/build-harness loses 62 (bare git URL)
; cloudposse/atmos loses 6 (bare git URL)
. What those references have in common is that they had to be inferred rather
than read: a bare git URL sitting in a shell script or a README is a text signal rather
than a declared dependency, and a bare image name has to be guessed back to the
repository that publishes it. Riftmap scores both below the floor and never counts them.
That is a deliberate choice about what the word "dependency" is allowed to mean, and it
costs this org its highest raw numbers.
Check it rather than trust it. Both columns are recomputable from the scan itself: every parsed reference as CSV — including the ones below the floor, each flagged — and the repository list with its archived flags and scan timestamps. Same export the nine-org scan publishes, per org.
See what your own org looks like.
The graph above is what you get back — interactive, file-level evidence, impact mode included. I'll sit down and look at a real cross-repo graph with you, live: a public org, or your own if you connect a read-only token. Or do it yourself: ~90 seconds to first scan, free for your whole org, up to 250 repos.
A 30-min video call with me. No pitch, no obligation.
Further reading
What 242 Cloud Posse repos actually depend on
A Riftmap scan of 242 Cloud Posse repos found 147 declaring terraform-null-label, 133 on context.tf line 24, plus what grep, symbol graphs, and catalogs miss.
Read the deeper dive