Software Quality Metrics and Code Analysis Cheat Sheet

Updated 2026-05-28

Next Topic: Software Resilience Patterns Cheat Sheet

🧠Study flashcards on this topic126 cards · spaced repetition→

Software quality metrics provide quantifiable measures for assessing code health, team performance, and system reliability throughout the development lifecycle. These metrics span from operational performance indicators like DORA metrics to structural code properties like complexity, coupling, and cohesion. In an era where AI-assisted code generation is accelerating development, understanding and tracking quality metrics becomes essential—not as vanity numbers, but as actionable signals that identify risk, guide refactoring decisions, and prevent technical debt from becoming technical bankruptcy. The key differentiator between high-performing teams and struggling ones isn't whether they use metrics, but whether they track the right ones and act on the insights they reveal.

What This Cheat Sheet Covers

This topic spans 22 focused tables and 130 indexed concepts, 126 flashcards. Below is a complete table-by-table outline of this topic, spanning foundational concepts through advanced details.

Table 1: DORA Metrics (DevOps Performance)Table 2: Developer Experience FrameworksTable 3: Code Coverage TypesTable 4: Cyclomatic and Cognitive ComplexityTable 5: Coupling MetricsTable 6: Cohesion MetricsTable 7: Object-Oriented Design Metrics (CK Suite)Table 8: Halstead Complexity MeasuresTable 9: Size and LOC MetricsTable 10: Maintainability and Technical DebtTable 11: Code Quality and Defect MetricsTable 12: Quality Process MetricsTable 13: Code Smell DetectionTable 14: Static Analysis Tools — PythonTable 15: Static Analysis Tools — JavaScript/TypeScriptTable 16: Static Analysis Tools — JavaTable 17: Static Analysis Tools — Other LanguagesTable 18: Enterprise Code Quality PlatformsTable 19: Security Testing MethodsTable 20: AI-Assisted Code Review ToolsTable 21: Architecture Fitness FunctionsTable 22: Advanced Quality Indicators

Quick IndexSubscribe to unlock

A jump-to index of every table row in this cheat sheet.

Mind MapSubscribe to unlock

An interactive map of every table and concept in this topic.

Table 1: DORA Metrics (DevOps Performance)

DORA (DevOps Research and Assessment) metrics are the industry's most research-validated framework for measuring software delivery performance, backed by over a decade of surveys involving 39,000+ professionals. The 2024 report expanded the framework to five metrics; speed and stability are not tradeoffs—elite performers consistently excel on all five simultaneously.

Metric	Example	Description
Deployment Frequency	`Multiple per day (elite, 16.2%)` `On demand to weekly (high, 44.6%)`	• Measures how often code is deployed to production. Elite teams deploy on-demand multiple times daily • low performers deploy monthly or less
Change Lead Time	`< 1 day (elite)` `< 1 week (high)`	Time from first code commit to production deployment. Shorter lead times signal streamlined pipelines and faster value delivery.
Change Failure Rate	`< 4% (elite)` `< 8% (high)`	Percentage of deployments causing degraded service. Elite threshold is under 4%—high rates signal inadequate testing or error-prone processes.
Failed Deployment Recovery Time	`< 1 hour (elite)` `< 1 day (high)`	Time to restore service after a deployment-caused failure. Replaces MTTR in DORA's evolved model—measures resilience and incident response effectiveness.
Deployment Rework Rate	`Ratio of unplanned hotfix deployments` `Tracks post-incident patches`	• Added in 2024 • ratio of unplanned deployments triggered by production incidents. Complements Change Failure Rate by capturing follow-on patches—no quantified benchmarks yet established

Table 2: Developer Experience Frameworks

Beyond DORA's delivery-focused view, newer frameworks capture productivity holistically—accounting for developer well-being, collaboration, and experience. Understanding these frameworks helps engineering leaders choose the right measurement approach for their organization's maturity level.

Framework	Example	Description
SPACE Framework	`5 dimensions: Satisfaction, Performance,` `Activity, Communication, Efficiency`	Research-backed model from Microsoft, GitHub, and UVic covering five productivity dimensions. Acknowledges human and social aspects—no single metric captures developer productivity.

The rest of this section is part of the full cheat sheet

Table 3: Code Coverage Types

Coverage metrics tell you which code was exercised during tests—but the type of coverage chosen determines how much of the logic space is actually verified. Higher coverage types give stronger guarantees at exponentially higher cost; choose the right level for the risk profile of each module.

Type	Example	Description
Branch Coverage	`if (x > 0) { ... } else { ... }` `// Both paths tested = 100%`	• Tracks whether all conditional branches (true/false for every `if`/`else`) are exercised. More meaningful than line coverage for decision points • the recommended default

The rest of this section is part of the full cheat sheet

Table 4: Cyclomatic and Cognitive Complexity

Complexity metrics quantify how difficult code is to test, maintain, or understand. Cyclomatic complexity measures structural paths; cognitive complexity captures the mental effort a human needs to follow the logic. Both are calculated automatically by all major static analysis platforms.

Metric	Example	Description
Cyclomatic Complexity	$CC = E - N + 2P$ `3 if-statements → CC = 4`	• Counts linearly independent paths through code (edges − nodes + 2×components). CC > 10 requires decomposition • CC > 25 is untestable—originally defined by McCabe (1976).

The rest of this section is part of the full cheat sheet

Table 1: DORA Metrics (DevOps Performance)

Metric	Example	Description
Deployment Frequency	`Multiple per day (elite, 16.2%)` `On demand to weekly (high, 44.6%)`	• Measures how often code is deployed to production. Elite teams deploy on-demand multiple times daily • low performers deploy monthly or less
Change Lead Time	`< 1 day (elite)` `< 1 week (high)`	Time from first code commit to production deployment. Shorter lead times signal streamlined pipelines and faster value delivery.
Change Failure Rate	`< 4% (elite)` `< 8% (high)`	Percentage of deployments causing degraded service. Elite threshold is under 4%—high rates signal inadequate testing or error-prone processes.
Failed Deployment Recovery Time	`< 1 hour (elite)` `< 1 day (high)`	Time to restore service after a deployment-caused failure. Replaces MTTR in DORA's evolved model—measures resilience and incident response effectiveness.
Deployment Rework Rate	`Ratio of unplanned hotfix deployments` `Tracks post-incident patches`	• Added in 2024 • ratio of unplanned deployments triggered by production incidents. Complements Change Failure Rate by capturing follow-on patches—no quantified benchmarks yet established

Table 2: Developer Experience Frameworks

Framework	Example	Description
SPACE Framework	`5 dimensions: Satisfaction, Performance,` `Activity, Communication, Efficiency`	Research-backed model from Microsoft, GitHub, and UVic covering five productivity dimensions. Acknowledges human and social aspects—no single metric captures developer productivity.

Table 3: Code Coverage Types

Type	Example	Description
Branch Coverage	`if (x > 0) { ... } else { ... }` `// Both paths tested = 100%`	• Tracks whether all conditional branches (true/false for every `if`/`else`) are exercised. More meaningful than line coverage for decision points • the recommended default

Table 4: Cyclomatic and Cognitive Complexity

Metric	Example	Description
Cyclomatic Complexity	$CC = E - N + 2P$ `3 if-statements → CC = 4`	• Counts linearly independent paths through code (edges − nodes + 2×components). CC > 10 requires decomposition • CC > 25 is untestable—originally defined by McCabe (1976).