研究背景：DevOps已成为行业内发展最快的软件开发范式之一。然而，这一趋势带来了在保持DevOps敏捷性的同时确保软件交付安全性的挑战。将安全集成到DevOps中的努力催生了DevSecOps范式，该范式正受到工业界和学术界的极大关注。但实践中采用DevSecOps被证明颇具挑战。研究目的：本研究旨在系统化梳理从业者在采用DevSecOps时面临的挑战，以及文献中已报道的 proposed 解决方案，同时明确未来需进一步研究的领域。研究方法：我们对54项同行评审研究开展了系统性文献综述（Systematic Literature Review），采用主题分析法对提取的数据进行分析。研究结果：我们识别出21项与采用DevSecOps相关的挑战、31项具体解决方案，并建立了二者之间的映射关系。我们还通过将现有解决方案与挑战进行整体评估，确定了该领域的关键空白区域。研究结果被划分为四大主题：人员、实践、工具与基础设施。研究结果表明，受该范式对自动化的需求驱动，与工具相关的挑战和解决方案是报道最多的。左移安全（Shift-left security）和持续安全评估是为DevSecOps推荐的两项关键实践。研究结论：我们强调需要面向开发者、针对DevSecOps中持续实践的应用安全测试工具。需要更多研究探索如何将传统的人工安全实践自动化，以适应快速的软件部署周期。最后，在交付速度与安全性之间实现恰当平衡，是从业者在DevSecOps范式中面临的重要问题。
英文摘要：
Context: DevOps has become one of the fastest-growing software development paradigms in the industry. However, this trend has presented the challenge of ensuring secure software delivery while maintaining the agility of DevOps. The efforts to integrate security in DevOps have resulted in the DevSecOps paradigm, which is gaining significant interest from both industry and academia. However, the adoption of DevSecOps in practice is proving to be a challenge. Objective: This study aims to systemize the knowledge about the challenges faced by practitioners when adopting DevSecOps and the proposed solutions reported in the literature. We also aim to identify the areas that need further research in the future. Method: We conducted a Systematic Literature Review of 54 peer-reviewed studies. The thematic analysis method was applied to analyze the extracted data. Results: We identified 21 challenges related to adopting DevSecOps, 31 specific solutions, and the mapping between these findings. We also determined key gap areas in this domain by holistically evaluating the available solutions against the challenges. The results of the study were classified into four themes: People, Practices, Tools, and Infrastructure. Our findings demonstrate that tool-related challenges and solutions were the most frequently reported, driven by the need for automation in this paradigm. Shift-left security and continuous security assessment were two key practices recommended for DevSecOps. Conclusions: We highlight the need for developer-centered application security testing tools that target the continuous practices in DevSecOps. More research is needed on how the traditionally manual security practices can be automated to suit rapid software deployment cycles. Finally, achieving a suitable balance between the speed of delivery and security is a significant issue practitioners face in the DevSecOps paradigm.
An overview of the use of alternative funding and contracting approaches relevant for agile software development: A systematic review of real-life experiences
Alias Robotics（Alias机器人公司）；Universität Klagenfurt（克拉根福大学）；UC San Diego（加州大学圣地亚哥分校）；Ca’ Foscari University of Venice（威尼斯福斯卡里大学）；Secura Factors srls（Secura Factors有限责任公司）；NeoFarm（NeoFarm公司）
A Systematic Literature Review of Soft Computing Techniques for Software Maintainability Prediction: State-of-the-Art, Challenges and Future Directions
On the Use of a Large Language Model to Support the Conduction of a Systematic Mapping Study: A Brief Report from a Practitioner's View
Federal University of Goiás\ Institute Goiânia Goiás Brazil；Pontifical Catholic University of Rio de Janeiro\ of Informatics Rio de Janeiro Rio de Janeiro Brazil；Boston University\ of Computer Science Boston Massachusetts USA；Federal University of Goiás\ Institute；Pontifical Catholic University of Rio de Janeiro\ of Informatics；Boston University\ of Computer Science
