openinframap - Moses Yebei

The Problem

OpenStreetMap (OSM) contains rich infrastructure data—power lines, substations, telecoms, water networks—but no dedicated way to visualize it. OpenInfraMap solves this by rendering that data as an interactive map at openinframap.org, turning raw OSM tags into a browsable, filterable view of global infrastructure.

What This Does

The repo is a collection of five self-contained projects, not a monolith: web/ (TypeScript/React frontend), web-backend/ (Python FastAPI-style server), schema/ (PostgreSQL views and functions), imposm/ (Python mapping OSM data into Postgres), and tegola/ (vector tile generation). Each has its own Dockerfile and CI workflow.

The pipeline is: imposm imports OSM PBF files into Postgres, schema/ defines the SQL views that shape that data, tegola serves vector tiles, web-backend provides a stats/chart API, and web renders the map. docker-compose.yml ties the services together.

How It Is Wired

Execution starts in two places. imposm/main.py is the import entry point—it maps OSM elements into database tables via funcs.py (functions like table, relation_tables, generalized_table). web-backend/main.py starts the web server; its main function reaches 5 downstream functions and touches the database via refresh_matviews using psycopg.connect.

The highest fan-in functions are result_to_df and figure (each called from 6 places), both in web-backend/charts/util.py—change these and the charting layer breaks broadly. latest_stats_date in web-backend/data.py is also called from 6 places. tegola/expire.py is the only file that runs an external command and writes files, handling tile expiry and directory cleanup.

The module graph shows a cycle in web/src/search/ (search.ts, coordinates.ts, opencage.ts)—mutually reachable imports that complicate refactoring. Two oversized files, web/src/style/style_oim_power.ts and style_base.ts (1,247 lines each), carry the visual styling logic and will be painful to modify.

How To Use It

Setup: docker-compose up is the intended path—each service has a Dockerfile. For local development, web/ uses npm (package.json present), web-backend/ uses pip/uv (pyproject.toml).

Configuration: The README does not document environment variables or setup steps beyond pointing to docs/architecture.md. Database credentials and connection strings are not documented in the repo.

Running it: No single entry point is documented. The README is 1,463 bytes and says only "see the architecture documentation"—which is absent from the file listing. This is the repo's biggest usability gap.

Real-World Use

A typical deployment: imposm ingests a regional OSM extract, schema/refresh_matviews.sql rebuilds materialized views on a schedule (covered by schema/jobs/update-stats.sql), tegola serves tiles to the React frontend, and web-backend answers chart requests like plant_count or line_length from web-backend/charts/. The web-router directory (3 files) likely handles routing between these services.

Code Health & Issues

Static analysis found 9 issues: 5 high, 4 medium. The import cycle in web/src/search/ is the only high-severity soundness problem. Two oversized files in web/src/style/ add cognitive load. Medium issues include 12 duplicated 6-line code blocks across 8 files, and deep nesting (depth 6) in web-backend/charts/country.py and views/area.py.

SDLC gaps: CI workflows use unpinned GitHub Actions tags (docker/login-action@v4)—a tag can be moved, risking supply-chain compromise. No permissions: block in 4 workflows, no Dependabot config, and python:3.12-slim in imposm/Dockerfile is unpinned by digest. Only 2 test files cover 63 source files (ratio 0.032). No .editorconfig or formatter config.

The Bottom Line

A production-grade infrastructure map with a sound three-tier architecture (import → tile → web) and clean separation between projects. The code is real and working—this is not a toy. The main weaknesses are documentation (no run instructions), weak CI hardening, and a thin test suite. Use it if you need to visualize OSM infrastructure data; expect to invest in docs and tests before production.

What the analyser found

Deployment readiness

7/7

Container image
CI pipeline
Lockfile committed
Test suite
README
License
No committed secrets

Composition

739 files

JSON37
TypeScript37
Python25
Markdown12
HTML11
YAML10

ReactDocker

Module dependencies

The 10 most depended-upon modules of 63, from static import analysis. Red outline marks a module in an import cycle.

graph LR n0_web_src_style_types["types"] n1_web_src_style_common["common"] n2_web_src_style_stylehelpers["stylehelpers"] n3_web_src_search_search["search"] n4_rc_style_style_oim_petroleum["style_oim_petroleum"] n5_web_src_click_router["click-router"] n6_web_src_l10n["l10n"] n7_le_style_oim_other_pipelines["style_oim_other_pipeline"] n8_eb_src_style_style_oim_power["style_oim_power"] n9_src_style_style_oim_telecoms["style_oim_telecoms"] n5_web_src_click_router --> n0_web_src_style_types n1_web_src_style_common --> n0_web_src_style_types n1_web_src_style_common --> n6_web_src_l10n n1_web_src_style_common --> n2_web_src_style_stylehelpers n7_le_style_oim_other_pipelines --> n1_web_src_style_common n7_le_style_oim_other_pipelines --> n4_rc_style_style_oim_petroleum n7_le_style_oim_other_pipelines --> n2_web_src_style_stylehelpers n7_le_style_oim_other_pipelines --> n0_web_src_style_types n4_rc_style_style_oim_petroleum --> n1_web_src_style_common n4_rc_style_style_oim_petroleum --> n0_web_src_style_types n4_rc_style_style_oim_petroleum --> n2_web_src_style_stylehelpers n8_eb_src_style_style_oim_power --> n1_web_src_style_common n8_eb_src_style_style_oim_power --> n2_web_src_style_stylehelpers n8_eb_src_style_style_oim_power --> n0_web_src_style_types n9_src_style_style_oim_telecoms --> n0_web_src_style_types n9_src_style_style_oim_telecoms --> n1_web_src_style_common n9_src_style_style_oim_telecoms --> n2_web_src_style_stylehelpers classDef cyc stroke:#ef4444,stroke-width:2px; class n3_web_src_search_search cyc;

What would stop me shipping this

Ranked by severity × confidence × production reach. Reach is the honest discriminator across a collection that is mostly other people's code: the same finding matters more in something that ships.

high1

medium6

low2

Pin third-party GitHub Actions to a commit SHAhigh2 occurrences

.github/workflows

docker/login-action@v4, docker/build-push-action@v7

A tag can be moved, so the action running with your token and secrets is whatever its owner last pushed; this is how tj-actions/changed-files leaked secrets from thousands of repos.

Fix: Replace each @vN with the 40-character commit SHA, keep # vN as a comment, and let Dependabot bump the SHAs.

Declare least-privilege permissions for GITHUB_TOKENmedium4 occurrences

.github/workflows/imposm.yml

4 workflow(s) declare no permissions, 4 of them reference secrets

With no declaration the token inherits the repository default, so any injected step can push commits or mint releases from inside your own CI.

Fix: Add permissions: contents: read at the top of the workflow and widen per job only where needed.

Enable Dependabot or Renovatemedium

2 manifest(s), no update bot configured

Without a bot a published advisory sits unpatched until someone audits by hand, which across 1,322 repositories means never.

Fix: Commit .github/dependabot.yml covering the repo ecosystems plus github-actions.

Pin the container base image by digestmedium

imposm/Dockerfile

python:3.12-slim

An untagged or mutable base means today's build and last month's contain different libc and a different CVE set, with no record of which shipped.

Fix: Use image:tag@sha256:<digest> and enable Dependabot's docker ecosystem.

Gate pull requests on a dependency vulnerability scanmedium

.github/workflows

no dependency scan in CI

This is the one gate that would catch a known-vulnerable package before it reaches a build, and no repository in the sample had it.

Fix: Add dependency-review-action on pull_request, or osv-scanner on push and a schedule.

Expand the README; it does not say how to run thismedium

README.md

1461 bytes of README for 63 code files

A 236-byte README for 1,302 files leaves no way to find the entry point, which is the state of the largest repository in this estate.

Fix: Add install, run, and one worked example.

Expand the test suite; it cannot cover this codebasemedium2 occurrences

2 test files against 63 source files (ratio 0.032)

A reviewer reads "has tests" and assumes a safety net that covers two files out of eighty-five, which is how untested paths ship behind a green badge.

Fix: Add tests for the highest fan-in modules first.

Set timeout-minutes on the workflow jobslow4 occurrences

.github/workflows/imposm.yml

4 workflow(s) declare no job timeout

A wedged step runs to the six-hour platform default, which on a two-hourly schedule means three runs overlap behind it.

Fix: Add timeout-minutes with a realistic bound to each job.

Add the repository convention files this project lackslow3 occurrences

missing .editorconfig, .gitattributes, a formatter config

Without them one contributor's editor writes tabs into a Python file, a shell script commits with CRLF and fails in the container, and a notebook diff is unreviewable.

Fix: Add .editorconfig, .gitattributes with text=auto eol=lf, and a formatter config.

Checked deterministically against the repository tree and a bounded set of its files: committed credentials, unpinned actions and base images, missing lockfiles and update bots, workflows that discard failures, published advisories against the declared dependencies, runtime configuration, licensing and notebook reproducibility. No language model is involved in this section.