To give some background, I work as a DevOps engineer. Now I have about 28 months of code quality metrics and incident data. I was curious to see if there was a link between code health and the number of production incidents, so I ran some time-series analysis on one application’s data.

I started by running the ADF test on each data series. There were 12 metrics in total, including security, reliability, maintainability, duplications, coverage, complexity per kLOC, bugs per kLOC, smells per kLOC, and a few others, along with incident count and median time-to-resolve. Some metrics had p-values above 0.05, so I used first-order differencing. After that, all ADF p-values dropped below 0.05, confirming stationarity.

Next, I ran the Ljung-Box test on each differenced series to check for any remaining autocorrelation. Nineteen out of sixty differenced series still showed autocorrelation (Ljung-Box p < 0.05) even after differencing. For these, I fitted AR(1) models and used the residuals.…