Arbor Docs

Quick Start

Get your first blast-radius report in under a minute. No configuration files, no YAML, no CLI setup.

How It Works

Arbor uses static analysis — not an LLM — to build a provably accurate dependency graph and compute the exact blast radius of any code change.

1. Webhook trigger

When a pull request is opened or a new commit is pushed, GitHub sends a webhook to Arbor. The webhook is verified with HMAC-SHA256 and a 202 is returned immediately — analysis happens asynchronously so GitHub never times out.

2. Shallow clone

Arbor clones only the HEAD commit of the PR branch into an ephemeral workspace. This keeps clone times under 5 seconds even for large repos. The clone is deleted after analysis completes.

3. AST parsing with Tree-sitter

Every source file is parsed with Tree-sitter to produce a concrete syntax tree. Tree-sitter supports incremental parsing and runs in milliseconds per file. Arbor extracts: function definitions, class declarations, import statements, function call sites, and type references.

4. Dependency graph construction

Parsed symbols are wired into a directed graph (powered by petgraph in Rust) where each node is a code symbol and each edge is a "calls" or "imports" relationship. Arbor resolves cross-file imports to connect edges across the whole codebase — not just within single files.

5. BFS blast-radius traversal

For each changed file, Arbor identifies which symbols were modified. It then runs a breadth-first search upward through the graph — finding every function that calls the changed symbols, then every function that calls those callers, up to the configured depth. The result is the precise set of affected nodes.

6. Centrality scoring

Each node gets a centrality score based on how many other nodes depend on it (similar to PageRank). High-centrality nodes are flagged explicitly — they're the ones where a small change has outsized systemic impact.

// Simplified: centrality = incoming_edges / total_edges_in_graph
// High centrality (>0.7) → flagged as high-risk node
// Combined with direct caller count to produce per-file risk level:

if centrality > 0.7 || direct_callers >= 5 || total_affected >= 20 {
    RiskLevel::High
} else if centrality > 0.4 || direct_callers >= 2 {
    RiskLevel::Medium
} else {
    RiskLevel::Low
}

Language Support

Arbor uses Tree-sitter grammars, which means language support is broad and adding new languages is straightforward. All languages share the same graph engine and analysis logic.

Reading Your Report

Every PR gets a structured comment posted by the Arbor bot. Here's exactly what each section means.

Commit Status Gates

Arbor posts a GitHub commit status on every PR — the green/red check in your PR's status area. This puts blast radius in the critical path of every merge decision.

Branch protection rules can require the Arbor status to pass before merging. Go to your repository settings → Branches → Branch protection rules → "Require status checks to pass before merging" → search for arbor/blast-radius.

Dashboard

The Arbor dashboard (available on Team and Enterprise plans) gives you a persistent view of blast radius trends across all your repos.

FAQ