How rowkavdev/ghostdeps works
GhostDeps statically compares declared dependencies with evidence from manifests, lockfiles, and source, then reports findings with confidence and limitations. Its main workflow is repository scan → ecosystem-specific detection and usage analysis → findings and recommendations → CLI or GitHub check output. The README also documents two PR integrations: a GitHub App and a GitHub Action. The tree and sampled excerpts support the main boundaries; some internal wiring and unsampled capability details are represented only where the documented workflow supports them.
Main entry points: analyse.ts Analysis engine · analyse-job.ts Analysis worker · run-adapter.ts Adapter runtime · scan.ts CLI scan
Components 24
User interfaces
- CLI commands
packages/cli/src/cli.ts - CLI scan
packages/cli/src/scan.ts - Action entry
packages/action/src/index.ts - Action check poster
packages/action/src/post-check.ts
Analysis engine
- Repository scanner
packages/core/src/engine/scanner/scanner.ts - Analysis engine
packages/core/src/engine/analyse.ts - Adapter runtime
packages/core/src/engine/run-adapter.ts - Dependency impact
packages/core/src/engine/impact.ts - Recommendation policy
packages/core/src/recommend/index.ts - Result reporting
packages/core/src/report/index.ts
Ecosystem adapters
- JS/TS adapter
packages/adapters/javascript-typescript/src/adapter.ts - Python adapter
packages/adapters/python/src/adapter.ts - Rust adapter
packages/adapters/rust/src/adapter.ts - Go adapter
packages/adapters/go/src/adapter.ts
GitHub integrations
- GitHub App
packages/github-app/src/app.ts - Job queue
packages/github-app/src/jobs.ts - Analysis worker
packages/github-app/src/worker/analyse-job.ts - Repository checkout
packages/core/src/checkout/index.ts - Check renderer
packages/checks-renderer/src/render.ts - Check reporter
packages/github-app/src/checks/reporter.ts - Registry metadata
packages/github-app/src/worker/registry-metadata.ts
Other components
- Developer
- Pull request
- Source repository
Connections 28
- Developer → CLI commands: runs
- CLI commands → CLI scan: starts scan
- CLI scan → Analysis engine: requests analysis
- Source repository → Repository scanner: provides files
- Analysis engine → Repository scanner: scans
- Analysis engine → Adapter runtime: runs adapters
- Adapter runtime → JS/TS adapter: dispatches
- Adapter runtime → Python adapter: dispatches
- Adapter runtime → Rust adapter: dispatches
- Adapter runtime → Go adapter: dispatches
- Analysis engine → Dependency impact: derives impact
- Analysis engine → Recommendation policy: applies policy
- Analysis engine → Result reporting: produces result
- CLI scan → Result reporting: formats output
- Pull request → GitHub App: triggers
- GitHub App → Job queue: enqueues
- GitHub App → Analysis worker: creates worker
- Job queue → Analysis worker: dispatches job
- Analysis worker → Repository checkout: obtains source
- Analysis worker → Analysis engine: runs analysis
- Analysis worker → Registry metadata: requests facts
- Analysis worker → Check renderer: renders result
- Check renderer → Check reporter: supplies check output
- Check reporter → Pull request: posts check
- Action entry → CLI scan: runs analysis
- Action entry → Action check poster: posts result
- Action check poster → Check renderer: renders result
- Action check poster → Pull request: creates check