I had an idea, what if you analysed the bug tracker as well as the source code?
My idea is that you will be able to directly see which bugs were fixed in the VCS by looking for the commit closest to the time it was reported "fixed" in the tracker.
You would have another factor for your COCOMO analysis which could be used for determining the quality of the software written?