A resilient, easily maintainable software foundation is essential for delivering reliable public services. Refusing to settle for legacy standards, the Moravian-Silesian Region (MSK) IT team proactively initiated a comprehensive, data-driven code quality review. Together, we analyzed their web application ecosystem, pinpointed operational bottlenecks, and established a clear path toward long-term code quality and developer efficiency.
The MSK ecosystem consists of a network of applications built and maintained by a core team of five developers using PHP, the Nette Framework, and GitLab. The main goal of our joint effort was to review the current state of technical debt, identify structural bottlenecks that slow down feature delivery, and equip the team with sustainable, modern practices. Drawing on our experience building Codeac.io, we brought automated code analysis workflows directly into the project to provide a clear, data-driven foundation for our collaboration.
A note on data transparency: To protect operational privacy and public infrastructure security, exact numerical metrics and source code scores are intentionally omitted from this article. Instead, we focus on relative differences, trends, and architectural insights to illustrate the real-world impact of the changes.
Getting to Know the Ecosystem: A Quick Overview
Before diving deep into structural analysis, we wanted a quick overview to get acquainted with the codebase. Our journey began by mapping the actual volume of active business logic over a three-year development window from the Lines of Code perspective. Overall, the code was documented well, with about 12.8% of the lines being comments, which aligns with a healthy industry average. But when we plotted code growth over time, the graph didn't show a steady, organic climb. Instead, we spotted two sharp, anomalous spikes.
Analyzing these historical inflection points allowed the MSK team to isolate legacy growth artifacts, such as vendor directory or compiled assets committed during early, rapid deployment phases, from true feature development. By surfacing these historical spikes, the team gained a clear, unvarnished view of their core application growth.
More importantly, mapping the total volume brought a major architectural imbalance to light: one single repository, Project 5, was several times larger than all the other applications combined.
Uncovering the Application’s True Narrative
Mapping the total lines of code gave us a starting point and a clear bird’s-eye view of the landscape. But measuring software purely by volume is like judging a book by its page count; it tells you how long it is, but reveals nothing about how complex the plot is or how tightly the chapters are connected. To truly understand the story under the hood, we needed to look more deeply into its structural narrative: its complexity, logical paths, and class dependencies.
With hundreds of thousands of lines of code spanning multiple repositories, doing a manual line-by-line review was out of the question. Given the high standards of accuracy required for public-sector applications, we needed a solution that combined speed with exact precision. To achieve this, we combined the deterministic accuracy of AST-based static analysis with an AI-orchestrated workflow.
At its core, an Abstract Syntax Tree (AST) converts raw text files into a tree representation of the code's logical structure. Each node in the tree corresponds to a specific programming construct, such as a function, loop, or variable assignment. It is called "abstract" because it strips away superficial syntax details, like indentation, whitespace, or punctuation, and instead maps the core structural and logical constructs of the code into a tree.
By performing structural "slices" across the AST, our tooling could map exact metrics, identify repeated patterns, and uncover hidden structural similarities across different applications. This gave the MSK team an objective X-ray of the entire codebase, pinpointing the precise areas that needed targeted human attention.
Finding the Complexity Hotspots
Seeing the sheer size of Project 5 immediately raised a natural hypothesis: larger codebases typically correlate with higher complexity, and higher complexity is usually where technical debt hides. To test this theory, we turned our attention to Cyclomatic Complexity, which measures the number of linearly independent paths through a function or method. Every if, else, for, or case statement adds a path. High complexity makes code harder to test, review, and maintain without introducing side effects.
The structural analysis confirmed what the MSK team’s standards aimed for: across the ecosystem, average complexity scores remained exceptionally low. This proved that the lean five-person team consistently authors clean, localized, and well-structured logic under demanding public-sector deadlines.
However, relying purely on overall averages can mask isolated risks. The complexity analysis revealed that maintenance bottlenecks were not systematic across the platform. Instead, complexity was concentrated in several specific legacy modules, creating identifiable hotspots that could be targeted with surgical precision.
What Happens When Code Changes? Mapping the System's "Blast Radius"
High complexity inside a single function is one thing, but when complex code is also heavily relied upon by other parts of the code, the risk of defect escalates dramatically. In a highly coupled system, every modification threatens to trigger a downstream domino effect. To safeguard system stability during future updates, we evaluated the Coupling Between Objects (CBO) metric to map inter-class dependencies across the project. We were looking specifically for coupling hubs: classes that are so heavily relied upon by other parts of the system that any single modification carries a massive risk of breaking something downstream.
Our dependency graph pointed straight back to Project 5. It had served as the foundational workhorse for regional digitization. As feature demands grew, it naturally evolved into a dense core monolith.
Mapping Coupling Between Objects (CBO) metrics to identify coupling hubs for future decoupling.
Armed with precision dependency mapping, the MSK team now has the exact data needed to confidently begin decoupling this battle-tested core into smaller, well-encapsulated logical blocks to, improving long-term maintainability without disrupting live public services.
Closing Environmental Blind Spots and Securing the Pipeline
Finally, we ran automated security scans across all repositories and their open-source libraries, cross-referencing them against known CVE databases.
Our joint effort pinpointed a few key vulnerabilities within outdated open-source dependencies. Rather than leaving these risks unnoticed, the MSK team rapidly remediated the high-severity flags by updating to the latest secure library versions.
To further harden the release pipeline, our analysis highlighted a few instances of missing lockfiles (composer.lock and package-lock.json) that could cause version drifts between development and production environments. The MSK team quickly resolved these gaps, boosting overall build reliability and helping prevent potential security regressions in future releases.
Charting the Way Forward
By connecting structural metrics directly to real-world impact, we provided the MSK engineering team with a practical, prioritized roadmap:
- Secure the Pipeline: Patch outdated libraries and commit strict lockfiles (composer.lock / package-lock.json) to guarantee consistency across dev and production.
- Deconstruct Project 5: Explore opportunities to gradually break down the monolithic into smaller, more modular services to reduce coupling and eliminate maintenance bottlenecks.
- Automate Quality Gates: Enhance the current Continuous Integration (CI) pipeline by integrating automated static analysis and improving test coverage to catch regression risks early.
- Unify Standards: Deploy a shared static analysis configuration across all projects to automatically enforce clean, consistent code style across the team.
Proactively reviewing and refining a software ecosystem is the sign of a mature, forward-thinking engineering team. By taking a data-driven approach to their codebase, the Moravian-Silesian Region IT team has set a high benchmark for public-sector technology leadership.
Armed with AST-backed metrics and automated CI/CD safeguards, MSK’s five-person engineering team is now positioned to ship new digital public services faster, safer, and with architectural clarity. We are proud to have collaborated with a regional team so dedicated to engineering excellence.
Top comments (0)