Cross-Repo Analysis

Enterprise

Catch the break in the repo you didn't touch.

Gitar checks every pull request against the other repositories in your organization and tells you what your change breaks, where, and which side should fix it, before it lands.

Book a demo Follow the blueprint
sharedpayments-apiweb-appmobile-appidentity-servicebilling-workerpayments-apiweb-appsharedidentity-servicesharedmobile-apppayments-apibilling-workerCross-Repopayments-api → web-appweb-app still reads payment_statusCross-Reposhared → identity-serviceidentity-service rejects tokens after the issuer changesCross-Reposhared → mobile-appmobile-app signs users out during background syncCross-Repopayments-api → billing-workerbilling-worker still listens for payment.succeeded
The problem

Contracts don't live in one repository.

Repositories are related by more than imports. When one side of a contract changes, a review of that repository alone can't see the other side. So the break is discovered in production, by the team that didn't cause it. 

1. Invisible ties

A route path, an event name, or a database column links two services with no shared package between them. Nothing in the diff shows it.

2. Green CI, broken system

Each repository passes its own review and CI. The break surfaces after merge.

3. No one knows every repository

Reviewers know their own service. They can’t know every repository that depends on it, and AI-generated PR volume makes the gap wider.

How Gitar solves it

From diff to finding, in three steps.

Scan the organization

Gitar narrows every repository in your organization down to the ones your change can reach. Nothing to link or enrol.

Check the diff against them

Gitar asserts your diff against those repositories. Each impact is verified against your PR before you see it.

Report what breaks, and how to keep it working

The finding sits on the line in your PR that changed the contract, names the affected repository and the file and function that break, and gives your options: keep the change backward compatible, or sequence the rollout so nothing breaks at runtime. It also says which end to fix: this PR, a follow-up in the other repository, or both.

A field removed in payments-api, flagged where web-app still reads it
The capability in detail

What Cross-Repo Analysis covers.

nothing to link

Automatic and unlimited

Every relevant repository in your organization, on every review. Unlimited linked repositories, discovered automatically as your organization grows.
routes · events · enums

Beyond imports

A route, a wire field, an enum value or an error code ties two repositories together. No shared package required.
GitHub ↔ GitLab

Any code host

A service in a GitHub repository and a client in a GitLab repository are checked against each other.
UI keys · subscribers

Missing counterparts

Ship one side of a feature and see the counterpart the other repository never got, like a UI key with no server handler or an event with no subscriber.
workflows · base images

Shared CI and images

Change a shared CI action, workflow or base image and see which repositories' builds go red on their next version bump.
tables · columns · layouts

Data changes

Change a table, column or file layout and see the downstream job, warehouse model or migration that has to move with it.
patch bumps

Versioning

A breaking change to a published contract under a patch version bump means callers auto-upgrade into the break. Gitar flags that it needs a major tag or a deprecation window.
default-branch check

Unmerged dependencies

Code that compiles against a symbol from another repository is flagged when that symbol isn't on the default branch yet, only in an unmerged PR or an unpinned branch.
visibility-aware

Safe with private code

A PR is only matched against repositories its readers could already see. A public PR never names a private repository or describes its contents.
.gitar/cross-repo.md

Tuned in plain English

Describe which repositories depend on this one, what has to stay consistent and what to leave alone, per repository or across the organization.
labeled Cross-Repo

Inline on the PR

Findings are labeled Cross-Repo and post inline like any other code review finding.
Dashboard > Cross-repo

Admin dashboard

Enterprise admins explore repository connections and filter findings by repository, status or fix location.
Try it yourself

Follow the blueprint.

A step-by-step developer guide from Sonar for setting up and trying Cross-Repo Analysis.

Blueprint

Gitar Cross-Repo Analysis for breaking contract changes

See how Gitar finds broken contracts across repositories during pull request review, from CI workflow permissions to deployment configuration mismatches, before changes reach production.

Follow the blueprint

Related blueprints

Blueprint

Teach Gitar your team's conventions with Knowledge

Step by step: explain a convention in a PR comment, then see Gitar apply it and cite the source in a later review.

 Blueprint

Gitar Risk Triage and Cross-PR Analysis for sensitive code

Mark sensitive paths high risk, catch two open pull requests that break only when both merge, and auto-approve only low-risk changes.

Don't just review. Ship.

Free 14-day trial. No credit card required.

Install nowRequest a demo