Skip to main content

​
Improvements

Every GitHub Actions uses: line, with the action it names. For a repository that ships several actions or reusable workflows, Riftmap used to record only owner/repo — never which action a consumer called — and kept just the first reference to that repository in each workflow file. It now stores one declaration per uses: line: raw_reference is the full path (grafana/shared-workflows/actions/send-slack-message, or owner/repo/.github/workflows/release.yml for a reusable workflow), version_constraint is that line’s own ref, and source_line is the line it is written on, even when the same line is repeated across jobs. Local ./ and self-repository $/ references are skipped. Reusable workflows in an org’s .github repository now resolve. cloudposse/.github/.github/workflows/x.yml was cut down to the bare owner and never became an edge. It now resolves to cloudposse/.github, and GitHub Actions references match their repository case-insensitively, as GitHub does (posthog/.github → PostHog/.github).

​
API changes

  • GET /repositories/{id}/dependents returns one row per use. Rows are deduplicated on declaration identity — consumer, dependency type, version, file, raw_reference and line — so a consumer using several of a repository’s actions or packages appears once per use. The consuming repository is target_repository_id; group by raw_reference to list consumers per action or package. X-Total-Count counts these declarations, not repositories. See Group dependents by action or package.
  • GET /repositories/{id}/context adds dependent_repositories_total, the number of distinct repositories behind dependents_total.
  • GET /artifacts/{id}/versions consumer_count now counts distinct consuming repositories per version. It used to count declarations, so a repository declaring the same version twice (two Dockerfiles, a dev and a peer entry) was counted twice.
  • Declaration counts rise on rescan. Repeated declarations of one reference in a file — a second uses: of an action, an npm package listed as both a dev and a peer dependency, a repeated Dockerfile FROM — are now separate rows, so total_declarations and the declaration_outcomes buckets grow for an org once it is rescanned. Graph edges and repository-level dependent counts are unchanged.
The API changes apply as soon as they ship. The parsing and resolution changes apply to a repository once it is rescanned; until then its rows keep the earlier shape, so its /dependents rows carry only the hub’s owner/repo.