Dependably.CodeMetrics 0.1.1

codemetrics

Quantitative C# code-quality metrics from one command: cyclomatic and cognitive complexity, Halstead volume, maintainability index, depth of inheritance, class coupling, LCOM4 cohesion, and the Robert Martin namespace metrics. Built on Roslyn, so it runs on any repository with no dotnet restore step. On top of the raw numbers it emits interpreted diagnoses (god class, fragile base class, unmaintainable hotspot, low cohesion, ...) with a severity you can gate on.

Install

Requires the .NET SDK 8.0 or later.

dotnet tool install --global Dependably.CodeMetrics

This puts the codemetrics command on your PATH.

Usage

codemetrics ./src                             # human report
codemetrics ./src --format json               # JSON on stdout
codemetrics ./src --fail-on severity=high     # CI gate: exit 1 if any finding is >= high

<path> is a file, directory, .csproj, or .sln. The human report lists the worst methods, types, and namespaces by metric, followed by the interpreted diagnoses (god class, unmaintainable hotspot, low cohesion, ...) and a per-severity summary. Exit code is 0 (clean), 1 (a finding tripped the --fail-on gate), or 2 (usage error).

Run codemetrics --help for all options (--json, --top, --no-semantic, --exclude, --config, and the full --fail-on gate).

Configuration (.dependably)

codemetrics reads a shared, suite-wide .dependably JSON file, discovered by walking up from the analysis target to the repository root (or point at one with --config <file>). It reads the common section and its own codemetrics section; the tool section overrides common for scalars, unions the list keys, and merges rules per metric id.

{
  "version": 1,
  "codemetrics": {
    // Per-metric threshold gate. Every metric uses "max" (fail-above) except "mi", which uses
    // "min" (fail-below). A severity of "off" disables that metric's gate.
    "rules": {
      "cyclomatic": ["error", { "max": 25 }],
      "cognitive":  ["error", { "max": 30 }],
      "nesting":    ["error", { "max": 5 }],
      "lcom4":      ["error", { "max": 4 }],
      "coupling":   ["error", { "max": 20 }],
      "mi":         ["error", { "min": 20 }]
    },
    // Gate on interpreted-diagnosis severity (the same ladder --fail-on severity= accepts).
    "failOn": { "severity": "high" },
    "exclude": ["**/Generated/**", "Migrations"],
    // Grandfather specific metric violations so they no longer gate. Selectors are AND-ed;
    // codemetrics findings carry path (file glob), symbol (Type or Type.Member), and id (metric).
    "exceptions": [
      { "rule": "cyclomatic", "path": "src/Parser/**", "symbol": "Parser.ParseExpression",
        "reason": "grandfathered; refactor tracked in #142", "expires": "2027-06-30" }
    ]
  }
}

CLI options merge over the file: --fail-on overrides a metric threshold (or severity) and --exclude extends the globs. .dependably-check is the deprecated alias filename and is still read (with a stderr warning) during the migration window; the legacy failOn.<metric>: N form is a deprecated alias for rules: { "<metric>": ["error", { "max": N }] }.

License

Apache-2.0. Part of the Dependably tool suite.