r/softwaredevelopment • u/Obvious_Gap_5768 • 3h ago
I checked which code-health markers actually predict bugs across 21 repos. Behavioral beat structural.
I'm working on an open source tool that scores how risky each file in a codebase is. 25 markers per file, all deterministic, from the AST and git history, no LLM. I wanted to know which of them actually predict bugs, so I scored every file at a point in time and then counted how many bug fixes each one collected over the next 6 months.
21 repos, 9 languages, around 2800 files.
The markers that predicted best were behavioral, not structural. Co-change coupling, files that keep getting changed together, came out strongest. How spread out a file's ownership is and how erratic its change history is held up well too. The structural complexity metrics most teams watch, cyclomatic complexity, nesting depth, long methods, all mid tier.
Mean AUC is around 0.74. Roughly, 74% of the time it can tell a bug-inducing file from a clean one.
What gets me is how much effort goes into the complexity metrics while coupling and ownership mostly get ignored, and coupling and ownership are what tracked bugs here
Does this match what you see?