Universidade Federal do Ceará
Mestrado e Doutorado em Ciências da Computação

Título: Unveiling Invisible Threats: An Empirical Study on the Prevalence and Co-occurrence of Configuration Smells in GitHub Actions Workflows

Data: 07/03/2025
Horário: 16h
Local: Online

Resumo:

CI/CD pipelines may contain hidden misconfigurations, known as configuration smells, which can affect reliability, security, and maintainability. These subtle yet pervasive patterns do not always lead to immediate failures, but they expose workflows to latent risks, disrupting automation in ways that often go unnoticed. As the adoption of GitHub Actions continues to rise, these invisible threats demand urgent attention. This paper presents an empirical investigation into the widespread presence of configuration smells in GitHub Actions workflows. By analyzing thousands of workflows from public repositories, we uncover not only how widespread these smells are but also how they tend to co-occur, revealing hidden dependencies and recurring misconfigurations. Our study leverages GASH (GitHub Actions Smell Hunter), a static analysis tool designed to systematically detect and classify configuration smells. The findings expose the most prevalent configuration smells and unveil recurring co-occurrence patterns that suggest systemic weaknesses within CI/CD pipelines. These insights provide a fresh perspective on software automation quality, offering actionable recommendations for researchers and practitioners to fortify workflow configurations. By shedding light on these invisible risks, this study aims to empower developers in securing and optimizing the next generation of software automation.

Banca examinadora:

• Prof. Dr. Lincoln Souza Rocha (MDCC/UFC) – Orientador
• Prof. Dr. Windson Viana de Carvalho (MDCC/UFC)
• Prof. Dr. Camilo Camilo Almendra (UFC)