GitHub Actions工作流的复杂性、异质性与合规性的实证研究
An Empirical Study of Complexity, Heterogeneity, and Compliance of GitHub Actions Workflows
AI总结：
本研究分析Java、Python、C++仓库的GitHub Actions工作流，量化其复杂性、异质性与合规性，发现工作流设计依赖生态惯例，为该领域提供了可复现的实证基准。
摘要：
持续集成（CI）已成为现代软件工程的核心实践，支持快速且协作的软件交付。GitHub Actions（GHA）凭借与GitHub的紧密集成及不断增长的可复用工作流生态系统，成为领先的CI平台。尽管有大量文档和最佳实践，但对实际GHA工作流与推荐指南的契合度，实证认知仍有限。本研究分析Java、Python和C++仓库中GHA工作流的结构、复杂性、异质性与合规性，完成四项工作：（a）量化工作流复杂性；（b）识别重复及多样的结构模式；（c）评估对最佳实践的合规性；（d）比较跨语言的工作流设计。GHA工作流通常规模小、层级浅，且高度依赖外部动作，尽管存在重复的意图级模式，但序列级标准化有限。39.5%的工作流存在常见流水线前缀，但工作流序列异质性极高，仅1种序列超过5%的全局频率阈值。研究发现Java的显式测试采用率最低，Python遵循规范模板但安全实践较弱，C++工作流规模更大、结构更多样。合规性缺口普遍存在，尤其在权限、超时配置和SHA固定方面，可复用工作流仍很少见。无测试的构建模式表明，工作流设计更多由生态系统惯例和平台默认值驱动，而非最佳实践。这说明更好的默认值和工具可提升工作流的安全性、模块化和可维护性，研究者分析CI系统时应考虑语言和仓库层面的因素。总体而言，本研究为开源生态系统中GHA工作流设计的研究与改进提供了可复现的实证基准。
英文摘要：
Continuous Integration (CI) has become a core practice in modern software engineering, enabling rapid and collaborative software delivery. GitHub Actions (GHA) has become a leading CI platform due to its tight GitHub integration and growing ecosystem of reusable workflows. Despite extensive documentation and best practices, there is limited empirical understanding of how real-world GHA workflows align with recommended guidelines. This study analyzes the structure, complexity, heterogeneity, and compliance of GHA workflows across Java, Python, and C++ repositories. We (a) quantify workflow complexity, (b) identify recurring and diverse structural patterns, (c) evaluate compliance with best practices, and (d) compare workflow design across languages. GHA workflows are generally small, shallow, and heavily dependent on external actions, with limited sequence-level standardization despite recurring intent-level patterns. A common pipeline prefix appears in 39.5% of workflows, but workflow sequences are highly heterogeneous, with only one exceeding the 5% global frequency threshold. We observe that Java has the lowest explicit test adoption, Python follows canonical templates but shows weaker security practices, and C++ workflows are larger and more structurally diverse. Compliance gaps are widespread, especially in permissions, timeout configuration, and SHA pinning, while reusable workflows remain rare. Build-without-test patterns suggest that workflow design is driven more by ecosystem conventions and platform defaults than by best practices. This indicates that better defaults and tooling could improve workflow security, modularity, and maintainability, while researchers should account for language- and repository-level factors when analyzing CI systems. Overall, this work provides a reproducible empirical baseline for studying and improving GHA workflow design in open-source ecosystems.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
