Anyone can submit a repository - github.com is the only source, and no
composer.json is needed. A submission is turned down when the
repository is unknown, a fork, empty, larger than 10 GB, or less than 20%
PHP by the language breakdown github.com reports for it; everything else is
queued for a worker.
The worker clones it and checks out its release tags one after another. Only
major and minor releases are measured (5.4, 5.4.0) -
patch releases and pre-releases (anything carrying a -) are skipped,
as are a handful of releases whose date git cannot tell straight. On every
checkout,
phploc
reads every .php file of the working copy and leaves two numbers
behind: lines of code, and the average cyclomatic complexity of a class, dated by
the last commit that tag points at. The clone is deleted afterwards, the numbers
stay.
From then on the report keeps itself current: every night it refreshes stars and asks github.com which releases are missing, so a new minor turns up in the chart by itself - and a repository that did not release is not even cloned.
Cyclomatic complexity counts the paths through a piece of code: one, plus one for
every branch - if, case, while,
for, catch, &&, ||.
Code without a single condition scores 1. What is charted here is the average
over all classes of a release, so it says how branchy the average class of a
library is - not how large it is, and not how good it is.
It is one metric, and worth what a metric is worth. It travels well as a rough
measure of how many paths a test suite has to cover, and badly as a verdict: a
clear class holding one big match outscores a tangle of indirection
nobody can follow, and pushing branches into polymorphism lowers the figure
without lowering the thinking. The shape of a line over the years says more than
any point on it.
The data has its glitches, too. Whatever sits in a repository at a tag is measured, so committed dependencies, generated code and test suites count towards the average. Libraries that were split, renamed or imported from another version control system - Zend → Laminas, the early PHPUnit tags - carry dates and jumps their git history cannot explain. And a gap in a line is a release that was left out or could not be measured - not one that never happened.
Further reading: Wikipedia, McCabe, A Complexity Measure (1976), NIST 500-235.