This article explains what Code Traceability in AngusGit actually checks. After reading it, you can keep it separate from requirements tracking and from open-source license compliance. It only checks code similarity and duplication. It tells you which snippet matches which file on the same instance, at identical or high similarity. It does not search the internet, and it does not run by itself.
People also use “code traceability” to mean requirements tracking or license compliance. Those are different jobs from this duplicate check. Once they are separate, you know which page answers the question you have. Code traceability in AngusGit is available on Team and Enterprise. The entry is Advanced → Traceability in the sidebar.
1. Three things people mean by code traceability
The same words can be three different questions:
| What people say | The question they want answered | What answers it |
|---|---|---|
| Requirements tracking | Which requirement this code was written for, and which release shipped it | Commit messages, an issue linked on the pull request, and the release record |
| License compliance | Which open-source license a dependency uses, and whether you can use it | Dependency scanning (SCA) and the license check |
| Code similarity | Which piece of another project this code matches, and how close the match is | AngusGit Code Traceability |
The first two already have their own path in AngusGit. Requirements tracking uses an issue linked on the pull request: write Closes #number in the pull request title or description, where number is the issue number. After the pull request is merged, that issue closes, and the code and the requirement line up. License compliance uses the repository security scan. SCA (software composition analysis) means scanning which open-source components the project depends on. Neither of those jobs is done on the code traceability page. In the rest of this article, Code Traceability means only the third one: a code similarity check.
2. What AngusGit code traceability does
Open Advanced → Traceability. The page title is Code Traceability. The note says: “Compare code similarity and trace where duplicated snippets come from.” Each check on this page is a trace task. When you create one, you decide two things: what to check, and what to compare it with.
- Trace Target: the code to check, the “what”. It can be a Repository (you can pick a branch), a File in a repository, a Code Block you paste, or a Function.
- Traced repositories: the repositories to compare with, the “with what”. Pick 1 to 50 repositories on the same AngusGit instance. The comparison uses the code on their default branches.
When you create the task you can also change the similarity thresholds (files default to 80%, code blocks default to 90%). Lower them to see more results that are somewhat alike. Raise them to keep only code that is almost the same. How to tune them is in the next article.
After the task finishes, the result page shows an overall Duplicate Rate and Unique Rate, then places each match in a similarity band: Identical (95–100%), High Similarity (80–95%), Moderate Similarity (60–80%), Low Similarity (40–60%), and Unique Code (0–40%). Each match has Compare Code, which shows the two sides next to each other.
The finished task fixture: source vs dup (repo) is an example. The trace target is the repository xlliu/test-trace-source-example. The traced repository is xlliu/test-trace-dup-example. The result page shows traced repositories 1/1, traced files 2/2, and code lines 164/164. The duplicate rate is 84.52%, and the unique rate is 15.48%. Two matches fall in high similarity (80–95%): src/main/java/cloud/xcan/example/trace/InvoicePriceCalculator.java at 86.86% (73/94 lines), and src/billing.py at 82.18% (62/70 lines).
3. How it decides that two pieces are similar
You do not need the algorithm first. A rough picture of the comparison makes the result easier to read.
Code traceability does not compare the text one character at a time. It splits the code into words for that programming language, such as keywords, variable names, operators, and brackets, then looks for a run of the same words on both sides. A run of more than 50 identical words counts as one duplicated fragment. After the fragments are found, several similarity algorithms are combined into one score.
That has two effects. First, code that only changed indentation, blank lines, or comments gets the same judgment. Second, you can choose to ignore some edits. With Ignore Identifier Differences on, code whose variable names or function names were changed can still be recognized as similar. With Ignore Literal Differences on, code that differs only in strings and numbers can still be recognized as similar. Both switches are in Advanced Configuration when you create the task.
A few directories are left out of the comparison: directories whose names start with . (for example .git and .idea), plus node_modules and target. Those directories are mostly dependency packages and build output, and comparing them does not help.
4. Where it fits
Check duplication when a delivery is accepted. A contractor or a partner delivers a new repository, and you want to know how much of it duplicates projects the company already has. Set the delivered repository as the trace target, select the existing related repositories as traced repositories, then read the duplicate rate and which files are duplicated.
Find copy-and-paste code before a refactor. Several services each keep a copy of the same utility class, so one change has to be made in several places. Use code traceability to find those copies, then decide whether to pull them into a shared module.
Find where one piece of code also appears. You found a problematic snippet and want to know whether other projects have the same shape. Set the trace target to Code Block or Function, paste the code, and search the related repositories.
A few limits are worth confirming before you use it:
- The search stays on this instance. The comparison covers only the repositories you selected on the same instance. To find out whether the code comes from an open-source project, import that project into the instance first, then select it as a traced repository.
- It runs only when you start it. A push does not start a trace. Each run is created and started by hand.
- It does not judge a license. After similar code is found, whether you can use it, and whether you need to name the source, is a decision for a person.
Common questions
Why does Community have no Traceability menu?
Code traceability is available on Team and Enterprise. Community does not include it, so the menu is absent. That is an edition difference.
Does a high duplicate rate mean something is wrong?
A high rate is a hint. Projects on the same team often share a framework and templates, so a fair amount of similar code is expected. Open Compare Code and see which files are duplicated, and whether they are business code that should not have been duplicated.
How does traceability relate to code review?
They answer different questions. Code review looks at whether one change is right, and it happens on a pull request. Code traceability looks at whether a whole body of code resembles other repositories, and it is a separate check task. They can be used together: after a trace finds duplicated code, refactor it through a pull request, and let reviewers check that change.
Summary
People use “code traceability” for three jobs: requirements tracking, license compliance, and code similarity. AngusGit Code Traceability does the third. Each trace task compares a trace target (a repository, a file, a code block, or a function) with 1 to 50 traced repositories you selected on the same instance, piece by piece. It gives a duplicate rate, similarity bands from identical down to unique code, and the location of each match. It fits a duplication check when a delivery is accepted, a search for copy-and-paste code before a refactor, and a search for where one snippet also appears. The comparison stays on the repositories you selected, each run is started by hand, and it does not judge licenses. Code traceability is available on Team and Enterprise. Community has no Traceability menu. How to create a task and how to read the result are in the next article.
Conclusion: AngusGit Code Traceability (Advanced → Traceability) is a duplicate check that finds similar code across repositories on the same instance. Requirements tracking uses an issue linked on the pull request (
Closes #number). Open-source license compliance uses the repository security scan.
Top comments (0)