@conference {2025:profes,
	title = {Pipelines Under Pressure: An Empirical Study of Security Misconfigurations of GitHub Workflows},
	booktitle = {26th International Conference on Product-Focused Software Process Improvement (PROFES)},
	year = {2025},
	month = {December},
	address = {Salerno, Italy},
	abstract = {Continuous Integration and Continuous Deployment (CI/ CD) pipelines have grown in popularity in recent years and are essential in streamlining the process of development and deployment of high quality software. However, developers often overlook security concerns in CI/CD pipelines, opening the door to many vulnerabilities. This paper presents an empirical investigation of nine security misconfigurations sourced from a comprehensive review of security guidelines, developer blogs, GitHub documentation, and prior research. To study the presence, co-occurrence and yearly trends of these security misconfigurations within current CI/CD practices, we analyzed a large dataset containing the most recent version of over 200{\textquoteright}000 GitHub workflow specification files, taken from open source repositories. To aid us in this study, we developed Soteria, a static analysis tool equipped with custom detectors that can systematically identify security misconfigurations. Given that less than 1\% of the analyzed workflows do not include any misconfiguration, our detection tool makes a contribution to raise awareness about widespread security misconfigurations. Our findings challenge conventional practices and motivate the need for an urgent shift in how security principles are systematically applied in the development and operation of CI/CD pipelines with more robust and finer-grained security controls.},
	keywords = {CI/CD Build Pipeline, DevOps, GitHub Actions, Security Misconfigurations, Workflows},
	author = {Edoardo Riggio and Cesare Pautasso}
}
@conference {2018:icpe,
	title = {A Declarative Approach for Performance Tests Execution in Continuous Software Development Environments},
	booktitle = {9th ACM/SPEC International Conference on Performance Engineering (ICPE 2018)},
	year = {2018},
	month = {April},
	publisher = {ACM},
	organization = {ACM},
	address = {Berlin, Germany},
	abstract = {Software performance testing is an important activity to ensure quality in continuous software development environments. Current performance testing approaches are mostly based on scripting languages and frameworks where users implement, in a procedural way, the performance tests they want to issue to the system under test. However, existing solutions lack support for explicitly declaring the performance test goals and intents. Thus, while it is possible to express how to execute a performance test, its purpose and applicability context remain implicitly described. In this work, we propose a declarative domain specific language (DSL) for software performance testing and a model-driven framework that can be programmed using the mentioned language and drive the end-to-end process of executing performance tests. Users of the DSL and the framework can specify their performance intents by relying on a powerful goal-oriented language, where standard (e.g., load tests) and more advanced (e.g., stability boundary detection, and configuration tests) performance tests can be specified starting from templates. The DSL and the framework have been designed to be integrated into a continuous software development process and validated through extensive use cases that illustrate the expressiveness of the goal-oriented language, and the powerful control it enables on the end-to-end performance test execution to determine how to reach the declared intent.},
	keywords = {BenchFlow, DevOps, Domain Specific Language},
	doi = {10.1145/3184407.3184417},
	author = {Vincenzo Ferme and Cesare Pautasso}
}
@inproceedings {benchflow:2017:qudos,
	title = {Towards Holistic Continuous Software Performance Assessment},
	year = {2017},
	month = {April},
	pages = {159-164},
	publisher = {ACM},
	address = {L{\textquoteright}Aquila, Italy},
	abstract = {In agile, fast and continuous development lifecycles, software performance analysis is fundamental to confidently release continuously improved software versions. 
Researchers and industry practitioners have identified the importance of integrating performance testing in agile development processes in a timely and efficient way. 
However, existing techniques are fragmented and not integrated taking into account the heterogeneous skills of the users developing polyglot distributed software, and their need to automate performance practices as they are integrated in the whole lifecycle without breaking its intrinsic velocity. 
In this paper we present our vision for holistic continuous software performance assessment, which is being implemented in the BenchFlow tool.
BenchFlow enables performance testing and analysis practices to be pervasively integrated in continuous development lifecycle activities. 
Users can specify performance activities (e.g., standard performance tests) by relying on an expressive Domain Specific Language for objective-driven performance analysis. 
Collected performance knowledge can be thus reused to speed up performance activities throughout the entire process.
},
	keywords = {BenchFlow, Continuous Software Performance Assessment, DevOps},
	doi = {10.1145/3053600.3053636},
	url = {http://qudos2017.fortiss.org/program/},
	author = {Vincenzo Ferme and Cesare Pautasso}
}
