Review + written encourages buddy-buddy dynamics.

Build failure rates encourages frustration as long as you don't provide ways to run the exact tests in isolation locally, under the same rules as CI. Meanwhile, branch triggers and pre-push hooks trivialize this further.

Most of these metrics are strange given they are trivial to check pre-merge. Meanwhile, running these statistics pre-merge discourages small commits and sharing code prior to having ideal builds.

The moment this gets out is the moment devs will game your statistics and any benefit you gain goes out the door. And almost every one of these, even combined, is easy to game.

Correct, we do not tell the devs these are being measured

I cannot tell if you are aware you're setting devs up for failure or not. Half your mentioned metrics are tackled by hard forcing your devs to run branch CI prior to merging and giving them a slap on the wrist for not running CI checks locally pre-push.

If they are important enough to measure, why not hard force them and focus on the remaining metrics instead?

See where I said “none taken as absolute because there are assumptions in each one”

And

“Use these as a springboard for deeper analysis of devs”

These are only used as high level metrics to guide further analysis, we are keenly aware of the faults of these metrics - but the alternative of no-metrics or worse, “gut feel”, is slow and riddled with more problems.

It doesn’t mean a dev is bad, maybe it means there’s some tooling failure, or organisational problem, or personal problem they need help with. These metrics give visibility into anomalies, and their imperfect nature doesn’t mean they are useless.

There’s also like 20 more metrics but I’m on my phone and couldn’t recall them all right now

Also I don’t know where all of this nonsense about “forcing” to run CI/CD before branch merges and “slap on the wrist” - all our devs can run the test suites locally in docker and inside their IDE, nobody is forced to do anything in the pipeline severs, and also nobody gets a slap on the wrist for CI/CD failures, actually I like to see larger changes with more failures because it means the dev is trying and I consider this normal behaviour, your incorrect assumptions about our test environment and how we interpret these metrics sound like you’re projecting.

If you _need_ «metrics» it’s because you _really_ don’t understand the contribution of your reports.

i.e. you are not a competent manager by the usual understanding of «competent».

I’m not a manager, I’m a dev (well senior dev, that’s why I know about the metrics), but I am measured by the same standards as everyone else. When I became aware of then I viewed my own reports, and found areas I can improve on. I like it.

The metrics actually showed no surprises when I saw them, had I been asked to name the worst 5 devs, I would have named the same people that the metrics would have highlighted.

So what you're saying is that it's useful for devs to be able to view their own stats for this on a no blame basis, and you have used your privileged position of access to them to improve your own performance, but you don't let the other devs do the same because you want to keep using these as secret metrics to manage them. Do I have that right?

No, I was asked my management to review the reports and help them interpret them, I would gladly give all the devs access to the reports, but that decision is not mine.

I raised this suggestion with management, but since we had a handful of devs who were drastically underperforming we decided to help them out first with increased mentorship.

I don’t know why you’re assuming the worst and malicious intent, it’s a great place to work, especially when we have a good vibe and all enjoy working together.

I think what contributes to this positive environment is not employing developers who instantly assume malicious intent, and aren’t paranoid about being discovered as incompetent. These people are usually the ones most opposed to metrics, and also are the ones who the metrics show are the worst performers. Instead of objectively assessing the facts they attack the messenger, full of emotion and vitriol because of their insecurities and inabilities.

Collecting and then using metrics like these in secret and without transparency for those being measured by them is unethical. The decision may not have been yours, but it's one you've chosen to go along with and support.

Maybe your company is still a great place to work in spite of that. Or maybe it's only a great place for you to work, and your colleagues would feel differently if they knew about this. I can't say for sure because I don't have any further insight into your company. But that's also not the point about why it's unethical.

Nor is it having a 'bad attitude', assuming the worst, or being full of negativity to be opposed to the secret use of metrics in this way.

Ah yes, the ethics argument, completely subjective and therefore impossible to refute, the last refuge of the exposed.

I see the metrics as a chance to provide visibility and support, you see it as a way to “manage” the devs. I see a chance to help, you see tyranny.

I see my viewing of my own metrics as a chance to introspect with an open mind and a willingness to see fault in myself and improve, you see an abuse of authority and a land grab to get ahead.

Then you say “I’m not assuming the worst, or full of negativity” when clearly you are, you just demonstrated it.

So like you, let me fall back on the ethics argument:

I think it’s unethical for a software manger not to take machine collected metrics and to manage on “gut feel” and intuition, just as all gut feel and intuition are not explained as rationale to all decision making (thus are also “secret metrics” - i.e. collected without transparent knowledge of all reasoning)

I think it’s unethical not to have secret metrics and inform every person of every thought and data point you have, so there aren’t any secret measures. (You better call your bank, your insurance company and loan companies and marketing companies who are all collecting secret metrics on you, in the sense their rationale, data points, and algorithms are not 100% open and are therefore secret)

I think it’s unethical to distribute reports that might demoralise some devs without helping them out first, especially if we know some of these reports might look unfair, and we are only using them as springboards for further investigation, like I have mentioned many times in this thread.

I think it’s unethical to complain about ethics and not address any of the points in the above discussion with objective facts.

But ethical things are ultimately subjective, so our conversation ends there, we will have to agree to disagree.

You're judge people people by secret measures?

What company are you working for? Human "resources" department, I guess?

Looks like a place to strongly avoid because of very bad ethics and culture!

I don’t understand this response, all of us judge each other all of the time on secret, unspoken metrics, that’s human nature. Our entire culture and society is partly built on what is not said.

Your bank is scoring you by machine, so is your insurance company, and loan companies, are their algorithms 100% open and publicly available? No. Because they are secret metrics. Your bank knows more about you than you know, and so do the loan companies, I know, I used to work there. The datasets the loan companies have are insane, I could see if you are in financial distress or not, the value of your house, whether you were a “complainer” or not, your favourite music, whether you’re a foodie or not, and heaps, heaps more, I think 250 attributes on each person in the USA at one company.

What difference does it make if some metrics are collected by machine and not fuzzy, vague, human intuition? I think it’s an improvement.

Yes the metrics inform the seniors decisions partially like I said above, and yes they are taken with a grain of salt, like I said above, they are inputs for deeper investigation, that’s it.

Here’s an example that happened just the other day: I noticed heaps of CICD failures for one dev and I reached out to him. He told me he couldn’t easily run the test suite, so I spent an hour peer coding with him and showed him how to use VSCodes debugger.

1 day later he called me up and told me that “using the debugger was a life changer” and he was thrilled to be working so quickly, the faster feedback cycle from code->debug had restored his enthusiasm for work.

the problem is some day the information will leak and the ones who know start gaming the metric.

I'm not sure.

> Lines of code written

Less is better, right?

Because it's really easy to throw code at a problem.

OTOH it's hard to come up with an optimal minimal solution.

> Lines of code rewritten (changed N days after)

Means: Your devs commit unfinished, not thought out crap.

Or: Management is a failure because they change requirements all the time.

> Lines of code removed

More is better, right?

Because cleaning up your code constantly to keep it lean is key to future maintainability.

But could be also a symptom of someone with a NIH attitude.

Or, management is a failure because they don't know what they want.

> Lines of code that contributed to linting problems

If it's more than zero that's a symptom of slacking off and / or ignorance.

Your local tools should have showed you the linting problems already. Not handling them is at least outright lazy, and maybe even someone is trying to waste time by committing things that need another iteration later on.

Or, your linting rules are nonsense, and it's better to ignore them…

> Lines of code that contributed to security issues (as reported by the static analyser)

Quite similar to the previous.

Ignorance or cluelessness. Maybe even the worst of form of "I don't care", while waiting whether your crap passes CI.

In case someone doesn't know how to handle such warnings at all you have a dangerously uneducated person on the team…

Or, what is at least equally likely: Your snack-oil security scanners are trash. Producing a lot of the usual false positives (while of course not "seeing" any real issues).

> Average complexity measures

Completely useless on it's own.

Some code needs to be complex because the problem at hand is complex.

Also more or less most of this measures are nonsense. The complexity measure goes usually down when you "smear" an implementation all over the place. But most of the time it's more favorable to concentrate and encapsulate complex parts of your code. Hundred one-line methods that call each other are more complex than one method with hundred lines of code. But the usual complexity measure would love the hundred one-liners but barf at the hundred line method.

If there's someone who constantly writes "very complex" code (according to such measure done by some tool) this can mean that this person writes over-complicated code, as it could mean that this person is responsible for some complex parts of the code-base, or is consolidating and refactoring complexity that was scattered all across the place. Or maybe even something else.

> CI/CD build failure rates

This means people can't build and test their code locally…

Or someone is lazy and / or ignorant.

Or, equally possible, your CI/CD infra is shit. Or the people responsible for that are under-performers.

Or your hardware is somehow broken…

> Lines of code reviewed

How do you even measure this?

Just stamping "LGTM" everywhere quickly would let this measure look good. But is anything won by that? I guess the contrary is more likely.

Also someone who's constantly complaining about others code would look good here…

OTOH valuable and insightful code review is slow, takes a lot of time and effort but does not produces a lot of visible output. That's why I think it's disputable whether this can be measured even in a meaningful way.

There is only one valid way to asses whether someone is productive: You need to answer the question whether what this person is doing makes sense in the light of the stated goals.

But to answer this you need to look at the actual work / things produced by the person in question, and not on some straw man proxy measures. All measures can be gamed. But faking results is much harder (even still possible of course).

I think these are excellent metrics for the engineering team to discuss at retro in aggregate.

But not so good for comparing Joe and Mo. Or even saying “how is Joe doing”. Unless the reviewer is very skilled in navigating that data without bias. Most people I have worked for wont be and will ruin the employee relationship by making some comment about how “this could improve” when the employee things “ok this is BS but better go along with it, and maybe i’ll open CV.docx tonight and give it a spring clean”.

Bullshit is the biggest turn off for me in jobs and I will leave a job with too much (some is to be expected and a side effect of getting groups to work together). Team leaders tracking my time and commits closely to judge performance is this. How should they judge? Best way is get people to pair often. You will know what they are actually doing that way or can talk to someone who did. Any real laggers will be found naturally, and then find out why and fix (might be onboarding sux for example).

People do hate paring I know but it doesn’t have to be all the time. Even an hour a day of someone jumping on to help will spread boats loads of useful information.