How It Works

From code change to risk score
in under 2 minutes.

Buildpathio integrates at the CI layer and builds your live service graph from actual traffic, config, and code — not documentation.

The Process

Four steps from install to insight

1
Connect

Install the GitHub App and drop a buildpath.yaml in your repo root. No manual service topology configuration. Buildpathio discovers structure from the code itself.

2
Scan

On every push, the scanner traverses import graphs, OpenAPI contract files, and optional Istio/Linkerd telemetry. Each data source catches a different class of dependency the others can miss.

3
Score

Blast radius (40%), change volume in dependency-critical files (25%), test coverage delta (20%), and dependency depth (15%) combine into a single 0–100 risk score per affected downstream service.

4
Surface

The buildpath/risk-score check appears inline in the PR — before any reviewer opens the diff. Also available in Slack, PagerDuty, and CLI output.

Graph Internals

How we build the live dependency map

Buildpathio combines three complementary data sources to build a map that reflects reality, not documentation:

  • Import scanner — static analysis of service source code identifies direct package and API dependencies at the code level.
  • OpenAPI spec reader — contract scanning across all openapi.yaml files detects cross-service API surface dependencies.
  • Service mesh trace aggregator — runtime traffic patterns from Istio or Linkerd telemetry validate and augment the static graph with actual call frequency.
dependency graph Import Scanner OpenAPI Spec Reader Service Mesh Traces Risk Score 87 / HIGH → Surfaced in PR check + Slack + CLI
Risk Scoring Model

How risk scores are calculated

Every risk score is a weighted composite of four signals derived from your graph and the current change delta.

LOW Score 0–30 — Safe to merge. Standard review required.
MED Score 31–65 — Requires second reviewer. Slack alert sent.
HIGH Score 66–100 — Merge blocked until senior engineer override.
Factor Weight Description
Blast radius 40% Number of downstream services transitively affected
Change volume 25% Lines changed in dependency-critical files
Test coverage delta 20% Coverage decrease for affected code paths
Dependency depth 15% Graph depth from changed node to leaf services

See your actual dependency graph — not what the docs say it is.

Free tier. GitHub App install to first risk score in under 4 minutes.

Start Free Read Quickstart