// free & open source dependency mapping
About to change a shared base image, Terraform module, CI workflow or library? Type your GitHub org. ripplemap reads the files your repos already have and shows everything a change would hit, down to the exact line.
Any public GitHub org, user or repo URL. It's scanned right in your browser, so nothing is uploaded. Private repos? Use the CLI.
Pre-scanned and refreshed every week, so they open instantly. Click one, then click any dot to see what a change to it would affect.
Every org with more than a handful of repos has the same problem: shared pieces get used everywhere, and nobody has the full list of who uses what.
Know exactly which repos to update and who to tell, before you merge, not after the pages start.
A GitHub Action comments with the repos a change may affect, and flags the ones that pick it up the moment it merges.
See which repos are still on an old base image, module, workflow or library version.
Find repos on latest or @main that will change underneath you.
The CLI works on private repos too, and nothing leaves your machine. Needs Node.js 22 or newer. If you're logged in with the GitHub CLI, that's all the setup there is.
$ npx ripplemap scan --org your-org $ npx ripplemap report --open
On Azure DevOps? Set AZURE_DEVOPS_TOKEN to a personal access token with Code (read) scope.
$ npx ripplemap scan --azure-org your-org $ npx ripplemap impact your-org/platform/templates
Not using gh? Set GITHUB_TOKEN to any token instead.
Save this as .github/workflows/ripplemap.yml in a repo others depend on. It reads files through the API and never runs the pull request's code.
name: ripplemap
on: pull_request_target
permissions:
contents: read
pull-requests: write
jobs:
impact:
runs-on: ubuntu-latest
steps:
- uses: Zintrivious/ripplemap@v0
No config, no agents, no server. Just the files that already say what depends on what.