CI/CD and DevOps path · Measure and run · Topic 12 of 13

DORA metrics: measuring delivery

Not started

DORA (DevOps Research and Assessment) has studied software delivery for more than a decade. Its software delivery performance metrics are a small set of outcome measures that predict both organisational performance and team well-being. The model has grown from the original "four keys" to **five metrics**, split into throughput and instability.

Why it matters: Without measurement, delivery debates are opinions. DORA's metrics are well researched, cheap to collect and hard to game if you track them together.

  1. 1Throughput

    Change lead time, deployment frequency and failed deployment recovery time: how quickly changes reach production and how fast you recover when one goes wrong.

  2. 2Instability

    Change fail rate and deployment rework rate: how often deployments need immediate fixing, and how many deploys are unplanned responses to incidents.

  3. 3Speed and stability go together

    DORA's research keeps finding that top teams do well on all five. Small, frequent changes are both faster and safer.

  4. 4Per service, for improvement

    Measure one application at a time, compare it with itself over time, and never use the numbers to rank teams or people.

1

How it works

The explanation, with examples you can run.

The five metrics

Throughput: how many changes move through the system, and how fast.

  • Change lead time: time from a change being committed to version control to it running in production.
  • Deployment frequency: how many deployments happen in a period, or the time between them.
  • Failed deployment recovery time: how long it takes to recover from a deployment that fails and needs immediate intervention. This replaced the older, broader "time to restore service" (MTTR).

Instability: how well deployments go.

  • Change fail rate: the share of deployments that need immediate intervention afterwards, typically a rollback or hotfix.
  • Deployment rework rate: the share of deployments that are unplanned and happen because of an incident in production.

Computing them

You need two event streams: deployments (with the commits they contain) and failures linked to deployments. This sketch computes the metrics for one service over a week:

⌘/Ctrl + Enter
OutputNot run yet

Press Run to see what your code prints, in order.

Runs in this browser, in an isolated frame with no access to this page. console.log, info, warn and error are shown; code runs as a classic script, so use an async function for await.

Medians are more honest than averages here: one change that sat for a month would drag an average far away from the typical experience.

Using them well

  • Track all five together. Pushing deployment frequency alone can raise the fail rate; chasing a low fail rate alone tends to slow everything down. DORA's data says the best teams do well on all of them, because small changes are both quicker and safer.
  • Per application, over time. Different systems have different contexts. Compare a service with its own history, not with another team's.
  • For learning, not ranking. As soon as the numbers decide bonuses, people optimise the numbers. Use them to find the bottleneck (review waits, slow tests, manual approvals) and check whether a fix helped.
  • Start rough. A spreadsheet of deploys and incidents for a month already shows where time goes. DORA's Quick Check gives a baseline in a few minutes.
2

Check yourself

3 questions. Get them all right to finish this topic.

  1. 1.In DORA's current model, how many software delivery performance metrics are there?
  2. 2.How does DORA define change lead time?
  3. 3.A manager sets a target of 20 deployments per day for every team. What is the likely result?

0 of 3 right so far. Get all three to finish this topic.