Source Code Repositories Research Articles

CI/CD integration tools for automated code deployment and verification for training purposes

The article is devoted to the study and application of modern tools for Continuous Integration and Continuous Deployment (CI/CD) in the educational field. Automating the processes of software deployment and testing is a relevant task for both improving the educational process and developing DevOps skills among students. Significant attention is given to studying the core principles of CI/CD, including automated testing, code quality monitoring, and integration with source code repositories. Popular CI/CD platforms such as Jenkins, GitLab CI/CD, and GitHub Actions are utilized to automate the educational process and train students. These tools enable the creation and deployment of applications using Docker technologies, which allow real-world scenarios to be modeled. A significant emphasis is placed on the scalability and adaptability of solutions, which enhance the efficiency of resource usage. A methodology for implementing CI/CD into an educational course is proposed, including integration with project management platforms and version control systems such as Git, with Gitea as an example. The main stages include setting up automated builds, testing, and deployment, which enable students to practice the principles of continuous integration and delivery. From the perspective of improving the efficiency of the educational process, the proposed methodology allows for the automation of assignment verification. The problems of Gitea and Jenkins integration are considered. A way for integrating these tools through locally installed Jenkins and Gitea with private code repositories has been proposed. Recommendations are provided for organizing the educational process through practical and laboratory work focused on real-world scenarios of software deployment and test automation. The results of the study confirm the effective use of CI/CD tools for educational purposes, ensuring the development of competencies required for working in modern IT teams. The use of CI/CD increases awareness of cybersecurity and optimizes DevOps processes.

Automated Mapping of Vulnerability Advisories onto their Fix Commits in Open Source Repositories

The lack of comprehensive sources of accurate vulnerability data represents a critical obstacle to studying and understanding software vulnerabilities (and their corrections). In this article, we present an approach that combines heuristics stemming from practical experience and machine-learning (ML)—specifically, natural language processing (NLP)—to address this problem. Our method consists of three phases. First, we construct an advisory record object containing key information about a vulnerability that is extracted from an advisory, such as those found in the National Vulnerability Database (NVD). These advisories are expressed in natural language. Second, using heuristics, a subset of candidate fix commits is obtained from the source code repository of the affected project, by filtering out commits that can be identified as unrelated to the vulnerability at hand. Finally, for each of the remaining candidate commits, our method builds a numerical feature vector reflecting the characteristics of the commit that are relevant to predicting its match with the advisory at hand. Based on the values of these feature vectors, our method produces a ranked list of candidate fixing commits. The score attributed by the ML model to each feature is kept visible to the users, allowing them to easily interpret the predictions. We implemented our approach and we evaluated it on an open data set, built by manual curation, that comprises 2,391 known fix commits corresponding to 1,248 public vulnerability advisories. When considering the top-10 commits in the ranked results, our implementation could successfully identify at least one fix commit for up to 84.03% of the vulnerabilities (with a fix commit on the first position for 65.06% of the vulnerabilities). Our evaluation shows that our method can reduce considerably the manual effort needed to search open-source software (OSS) repositories for the commits that fix known vulnerabilities.

Повышение эффективности работы в проектах Open Sourse на основе архитектурного анализа (на примере проекта Сахана)

The paper presents a methodology for entering an open source project using architectural analysis to develop programming skills and volunteer activities using architectural analysis. The relevance is due to the difficulty of entering into joint projects. As a method for solving this problem, it is proposed to use architectural analysis according to the C4 model. Using the example of the Sahana EDEN software project from the source code repository, the application of this method is described. Interest in this project is due to both its humanitarian goal and the large number of active participants, which makes it a significant example of intellectual volunteering. For each step of the architectural analysis, a detailed description of the results is presented - context, container and component diagrams. An analysis of the repository of an open source project should begin with an overview of the project structure and a study of the description, open questions, rules for making changes, current problems and technical debt. The importance of assessing one's own capabilities through studying the project's coding standards, problems and technical debt is substantiated. The conducted research showed that project work with open source software allows one to improve programming skills in practice, gain experience in joint activities and production communications, which allows us to recommend the comprehensive use of open source projects as an important educational activity for students.

Test Case Prioritization via Embedded Autoencoder Model for Software Quality Assurance

Software quality can be ensured by passing the process of software testing before the software is released. However, the software testing process involves many phases which leads to more resources and time consumption. Test Case Prioritization (TCP) has gained widespread acceptance because it prioritizes the tasks and reduces the number of phases and also produces results in good quality software free from defects. The coverage-based prioritization can be useful to distinguish each test case and result in a better prioritization process by using some algorithm. In this work, we propose a coverage-based prioritized test case generation using an Embedded Auto Encoder (EAE) algorithm which will produce an ordered sequence of the prioritized test cases. Initially, the code coverage for each benchmark has been extracted from the source code repository and is further processed to eliminate the noise in the data. The processed data will be given to the embedded autoencoder which consists of an autoencoder and a sparse autoencoder. Once the modeling is done, the model has been trained with the data generated by the Keras Data Generator class. The efficiency of the proposed EAE technique has been evaluated by using the APFD metric and the observations clearly show that the EAE framework proves to provide an APFD metric of 0.72 on average which is a good value in comparison to the previously deployed methodologies.

Methodology for collective location fixing of observed emergencies by intersection/resection based on mobile telecomunication application with cartographic interface

In modern higher education, it is required not only to prepare students to perform work on finished tasks in the subject area they have studied. It is also necessary to prepare students for independent activities, in which students do not work on ready-made tasks, but, on the contrary, are looking for niches in business, in which they themselves can offer in the subject area they have mastered, business-demanded solutions. This is another area of activity, which also requires development while studying at a university. It can be defined as "entrepreneurial competencies of a student." In recent years, the direction "Startup as a Diploma" has been developing, in which a university graduate protects not conditional academic work, but a real technological project with business prospects, to which the students developing it have ownership rights. The creation and maintenance of such projects changes the relationship between student and teacher, for this activity it is necessary to change the traditional teaching methodology. As a task of teachers, we decided to do the following: Find a subject area related to IT development, in which, due to recent achievements, there are opportunities for fast, technically not very complex technological solutions available to students, with the help of which you can create popular solutions. The work proposes an open source software development project, within which students can, performing tasks that are feasible for themselves, create software applications that are in demand in practice, as well as develop development strategies for related business projects. The project is dedicated to solving the problem of determining the coordinates of observed objects and phenomena based on data entered simultaneously by several users in different places using household mobile devices without using special technological equipment such as theodolites or tacheometers. The authors developed a mobile application, the value of which lies in the fact that in the public field allows you to realize the monitoring potential of the population interested in preventing unwanted or dangerous events and preventing emergency situations; professional allows you to assess the quality of the navigation signal in conditions of possible targeted interference; in the educational aspect organize training in the methods of joint fixation of objects and target designation on educational geopolygons. Currently, the project is being developed by students of the Department of Data Analysis and Machine Learning of the Financial University under the Government of the Russian Federation and the Moscow State University of Geodesy and Cartography. This paper presents a description of the project, the proposed solution architecture. References to source code repositories are given. The results of the pilot versions of the software are given.

Collaborative software project development with source code repository

Working on projects in isolation presents significant limitations. The lack of interaction and collaboration among students hinders the learning of diverse approaches, limits the expansion of understanding on a subject, and can decrease students' commitment and interest. Additionally, the absence of interaction negatively affects the development of key skills for academic and professional success. In the field of software project development, having a centralized source code repository is essential. It facilitates collaboration among team members, allowing them to work on the same project, make changes, review code, and solve problems together. It provides tools and functionalities that improve coordination and version control, resulting in more efficient and higher quality development. In summary, this article highlights the importance of collaboration among students and the use of centralized source code repositories to facilitate interaction, knowledge sharing, and ensure the quality of work in both academic and professional settings. It promotes collaboration through group projects, team activities, and online platforms that facilitate the exchange of ideas

An empirical examination of newcomer contribution costs in established OSS communities: a knowledge-based perspective

PurposeTo remain sustainable, open source software (OSS) projects must attract new members—or newcomers—who make contributions. In this paper, the authors develop a set of hypotheses based on the knowledge barriers framework that examines how OSS communities can encourage contributions from newcomers.Design/methodology/approachEmploying longitudinal data from the source code repositories of 232 OSS projects over a two-year period, the authors employ a Poisson-based mixed model to test how community characteristics, such as the main drivers of knowledge-based costs, relate to newcomers' contributions.FindingsThe results indicate that community characteristics, such as programming language choice, documentation effort and code structure instability, are the main drivers of knowledge-based contribution costs. The findings also suggest that managing these costs can result in more inclusive OSS communities, as evidenced by the number of contributing newcomers; the authors highlight the importance of maintaining documentation efforts for OSS communities.Originality/valueThis paper assumes that motivational factors are a necessary but insufficient condition for newcomer participation in OSS projects and that the cost to participation should be considered. Using the knowledge barriers framework, this paper identifies the main knowledge-based costs that hinder newcomer participation. To the best of the authors' knowledge, this is the first empirical study that does not limit data collection to a single hosting platform (e.g., SourceForge), which improves the generalizability of the findings.

DiffSearch: A Scalable and Precise Search Engine for Code Changes

The source code of successful projects is evolving all the time, resulting in hundreds of thousands of code changes stored in source code repositories. This wealth of data can be useful, e.g., to find changes similar to a planned code change or examples of recurring code improvements. This paper presents DiffSearch, a search engine that, given a query that describes a code change, returns a set of changes that match the query. The approach is enabled by three key contributions. First, we present a query language that extends the underlying programming language with wildcards and placeholders, providing an intuitive way of formulating queries that is easy to adapt to different programming languages. Second, to ensure scalability, the approach indexes code changes in a one-time preprocessing step, mapping them into a feature space, and then performs an efficient search in the feature space for each query. Third, to guarantee precision, i.e., that any returned code change indeed matches the given query, we present a tree-based matching algorithm that checks whether a query can be expanded to a concrete code change. We present implementations for Java, JavaScript, and Python, and show that the approach responds within seconds to queries across one million code changes, has a recall of 80.7% for Java, 89.6% for Python, and 90.4% for JavaScript, enables users to find relevant code changes more effectively than a regular expression-based search and GitHub's search feature, and is helpful for gathering a large-scale dataset of real-world bug fixes.

Multilayer self‐attention residual network for code search

SummarySoftware developers usually search existing code snippets in open source code repositories to modify and reuse them. Therefore, how to get the right code snippet from the open‐source code repository quickly and accurately is the focus of current software development research. Nowadays, code search is one of the solutions. To improve the accuracy of source code feature information representation and the accuracy of code search. A multilayer self‐ attention residual network‐based code search model (MSARN‐CS) is proposed in this paper. In the MSARN‐CS model, not only the weight of each word in the code sequence unit is considered but also the effect of embedding between code sequence units is calculated. In addition, an optimization model of residuals is introduced to compensate for the loss of information in the code sequences during the model training. To verify the search effectiveness of the MSARN‐CS model, three other baseline models are compared on the basis of extensive source code data. The experimental results show that the MSARN‐CS model has better search results compared with the baseline model. For parameter Recall@1, the experimental result of MSARN‐CS model was 9.547, which as 100.90%, 73.87%, 60.37%, and 2.55% better compared to CODEnn, CRLCS, SAN‐CS‐ and SAN‐CS, respectively. For the parameter Recall@5, the results improved by 26.67%, 36.23%, 36.21%, and 1.63%, respectively, and for the parameter Recall@10, the results improved by 13.92%, 25.70%, 20.78%, and 2.23%, respectively. For the parameter mean reciprocal rank, the results improved by 52.89%, 76.17%, 63.38%, and 3.88%, respectively. For the parameter normalized discounted cumulative gain, the results improved by 54.22%, 60.55%, 50.28%, and 3.30%, respectively. The MSARN‐CS model proposed in the paper can effectively improve the accuracy of code search and enhance the programming efficiency of developers.

Utilizing source code syntax patterns to detect bug inducing commits using machine learning models

Detecting Bug Inducing Commit (BIC) or Just in Time (JIT) defect prediction using Machine Learning (ML) based models requires tabulated feature values extracted from the source code or historical maintenance data of a software system. Existing studies have utilized meta-data from source code repositories (we named them GitHub Statistics or GS), n-gram-based source code text processing, and developer’s information (e.g., the experience of a developer) as the feature values in ML-based bug detection models. However, these feature values do not represent the source code syntax styles or patterns that a developer might prefer over available valid alternatives provided by programming languages. This investigation proposed a method to extract features from its source code syntax patterns to represent software commits and investigate whether they are helpful in detecting bug proneness in software systems. We utilize six manually and two automatically labeled datasets from eight open-source software projects written in Java, C++, and Python programming languages. Our datasets contain 642 manually labeled and 4014 automatically labeled buggy and non-buggy commits from six and two subject systems, respectively. The subject systems contain a diverse number of revisions, and they are from various application domains. Our investigation shows the inclusion of the proposed features increases the performance of detecting buggy and non-buggy software commits using five different machine learning classification models. Our proposed features also perform better in detecting buggy commits using the Deep Belief Network generated features and classification model. This investigation also implemented a state-of-the-art tool to compare the explainability of predicted buggy commits using our proposed and traditional features and found that our proposed features provide better reasoning about buggy commit detection compared to the traditional features. The continuation of this study can lead us to enhance software effectiveness by identifying, minimizing, and fixing software bugs during its maintenance and evolution.

A Protocol Based on Systematic Mapping Studies for Searching Health Applications in Non-Academic Repositories

Systematic mapping studies (SMSs) help obtain an overview of a research topic. SMSs are conducted with protocols that ensure their reliability and allow their replication by other researchers. The focus of an SMS is to identify peer-reviewed articles indexed in academic databases. Therefore, conducting an SMS does not encompass identifying software applications hosted in non-academic repositories. This article presents a protocol for systematic mappings in non-academic repositories (SMNARs). The SMNAR protocol was developed from adaptations of an SMS methodology consolidated in the literature and was aimed at assisting in the search, cataloging, and analysis of health software applications hosted in non-academic application and source code repositories. Thus, part of the adaptations was based on health application search approaches found in the literature. Two SMNAR user guides were developed, one designed for healthcare professionals and the other for software developers. To assess the feasibility of these guides, a study was conducted with participants from the healthcare and computer science fields. This study had both synchronous and asynchronous moments. In the former, a presentation contextualized the SMNAR protocol, proposed guides, and study procedures. In the latter, the participants partially planned and conducted an SMNAR using the proposed guides as support. Online forms were applied to obtain participants' perceived ease of use, perceived usefulness, and intention to use the proposed guides. The participants indicated good acceptance of the guides and suggested possible improvements in the protocol description. These results contributed to refining the SMNAR user guides.

Estimation of Neutral Mutation Rates and Quantification of Somatic Variant Selection Using cancereffectsizeR.

An R package provides streamlined, customizable estimation of underlying nucleotide mutation rates and of the oncogenic and epistatic effects of mutations in cancer cohorts.

ASTENS-BWA: Searching partial syntactic similar regions between source code fragments via AST-based encoded sequence alignment

Code search is a common activity in software development, and code-to-code search can benefit in a wide range of use-case scenarios. Code-to-code search uses a code fragment as the query for searching similar code fragments from large corpora. The results of a search can be applied to some software engineering tasks, such as search-based code recommendation, data-driven program repairing, and software plagiarism detection. To be put into daily use, the code-to-code search needs to find similar code fragments accurately and efficiently in a large dataset. Some search engines can locate exactly similar code, but are not able to search syntactical clones. Therefore, we propose ASTENS-BWA, a novel approach for searching syntactic similar code regions between code fragments via a tree-based sequence alignment. Source code has been transformed into a tree-based sequence that contains the structure information, and a sequence alignment algorithm has been applied to find similar regions. We evaluate ASTENS-BWA on three different tasks, the results demonstrate that our approach can find syntactical similar regions for programming code and retrieve similar code fragments fast and with high accuracy. As a code clone detection tool, ASTENS-BWA can report clone pairs in a high recall, but it needs manually check to reduce the false alarms. ASTENS-BWA is scalable and can report cloned code fragments in seconds for a code corpus of million lines of code. • Novel code clone search approach that scales to large source code repositories. • Quick searching syntactical clones between code fragments via tree-based representation. • Code clone search approach that can outperform state-of-the-art techniques. • Application of the proposed approach towards code recommendation and clone detection.

The OpenGATE ecosystem for Monte Carlo simulation in medical physics

This paper reviews the ecosystem of GATE, an open-source Monte Carlo toolkit for medical physics. Based on the shoulders of Geant4, the principal modules (geometry, physics, scorers) are described with brief descriptions of some key concepts (Volume, Actors, Digitizer). The main source code repositories are detailed together with the automated compilation and tests processes (Continuous Integration). We then described how the OpenGATE collaboration managed the collaborative development of about one hundred developers during almost 20 years. The impact of GATE on medical physics and cancer research is then summarized, and examples of a few key applications are given. Finally, future development perspectives are indicated.

Bots in Software Engineering

The theme of this issue is “Bots in Software Engineering,” and we’ve collected a number of recent papers about bots that interact with source code repositories. These papers were published at the fourth International Workshop on Bots in Software Engineering (BotSE ’22), the 37th ACM/SIGAPP Symposium on Applied Computing (SAC ’22), the International Conference on Information Systems (ICIS ’21), and the 19th International Conference on Mining Software Repositories (MSR ’22).

A consistent algorithm for finite-strain visco-hyperelasticity and visco-plasticity of amorphous polymers

Shared rheology elements of soft tissues and additive-manufactured amorphous thermoplastics benefit from a common visco-hyperelastic and visco-plastic constitutive framework. For finite-strain and general visco/elastic/plastic constitutive laws, allowing full anisotropy, we use the Kröner–Lee decomposition of the deformation gradient combined with Mandel stress-based yield function. Relatively weak conditions are necessary for specific laws to be incorporated in this framework. For example, stress-like variables present in visco-elasticity are removed from the list of constitutive unknowns. Constitutive iteration is performed for the elastic Cauchy–Green tensor Ce and the plastic multiplier increment Δλ. The source is here the right Cauchy–Green tensor provided by any discretization. For the integration of the flow law we adopt a scaled/squared series approximation of the matrix exponential. The exact Jacobian of the second Piola–Kirchhoff stress is determined with respect to this source, consistent with the integrator. The resulting system is produced by symbolic source-code generation for each yield function and hyperelastic strain-energy density function with each of the viscous terms added. The constitutive system is solved by a damped Newton–Raphson algorithm with the corresponding stress error being extensively assessed with stress error maps. A cellular beam structure is analyzed and results compared with experiments from our group. Some of the symbolic calculations and closed-form solutions are beyond what is manually achievable and therefore the symbolic sources for this work are made available in a source code repository.

Automatic Analysis of Available Source Code of Top Artificial Intelligence Conference Papers

Source code is essential for researchers to reproduce the methods and replicate the results of artificial intelligence (AI) papers. Some organizations and researchers manually collect AI papers with available source code to contribute to the AI community. However, manual collection is a labor-intensive and time-consuming task. To address this issue, we propose a method to automatically identify papers with available source code and extract their source code repository URLs. With this method, we find that 20.5% of regular papers of 10 top AI conferences published from 2010 to 2019 are identified as papers with available source code and that 8.1% of these source code repositories are no longer accessible. We also create the XMU NLP Lab README Dataset, the largest dataset of labeled README files for source code document research. Through this dataset, we have discovered that quite a few README files have no installation instructions or usage tutorials provided. Further, a large-scale comprehensive statistical analysis is made for a general picture of the source code of AI conference papers. The proposed solution can also go beyond AI conference papers to analyze other scientific papers from both journals and conferences to shed light on more domains.

Building a Secure Software Supply Chain with GNU Guix

The software supply chain is becoming a widespread analogy to designate the series of steps taken to go from source code published by developers to executables running on the users? computers. A security vulnerability in any of these steps puts users at risk, and evidence shows that attacks on the supply chain are becoming more common. The consequences of an attack on the software supply chain can be tragic in a society that relies on many interconnected software systems, and this has led research interest as well as governmental incentives for supply chain security to rise. GNU Guix is a software deployment tool and software distribution that supports provenance tracking, reproducible builds, and reproducible software environments. Unlike many software distributions, it consists exclusively of source code: it provides a set of package definitions that describe how to build code from source. Together, these properties set it apart from many deployment tools that center on the distribution of binaries. This paper focuses on one research question: how can Guix and similar systems allow users to securely update their software? Guix source code is distributed using the Git version control system; updating Guix-installed software packages means, first, updating the local copy of the Guix source code. Prior work on secure software updates focuses on systems very different from Guix -- systems such as Debian, Fedora, or PyPI where updating consists in fetching metadata about the latest binary artifacts available -- and is largely inapplicable in the context of Guix. By contrast, the main threats for Guix are attacks on its source code repository, which could lead users to run inauthentic code or to downgrade their system. Deployment tools that more closely resemble Guix, from Nix to Portage, either lack secure update mechanisms or suffer from shortcomings. Our main contribution is a model and tool to authenticate new Git revisions. We further show how, building on Git semantics, we build protections against downgrade attacks and related threats. We explain implementation choices. This work has been deployed in production two years ago, giving us insight on its actual use at scale every day. The Git checkout authentication at its core is applicable beyond the specific use case of Guix, and we think it could benefit to developer teams that use Git. As attacks on the software supply chain appear, security research is now looking at every link of the supply chain. Secure updates are one important aspect of the supply chain, but this paper also looks at the broader context: how Guix models and implements the supply chain, from upstream source code to binaries running on computers. While much recent work focuses on attestation -- certifying each link of the supply chain -- Guix takes a more radical approach: enabling independent verification of each step, building on reproducible builds, "bootstrappable" builds, and provenance tracking. The big picture shows how Guix can be used as the foundation of secure software supply chains.

The penumbra of open source: projects outside of centralized platforms are longer maintained, more academic and more collaborative

GitHub has become the central online platform for much of open source, hosting most open source code repositories. With this popularity, the public digital traces of GitHub are now a valuable means to study teamwork and collaboration. In many ways, however, GitHub is a convenience sample, and may not be representative of open source development off the platform. Here we develop a novel, extensive sample of public open source project repositories outside of centralized platforms. We characterized these projects along a number of dimensions, and compare to a time-matched sample of corresponding GitHub projects. Our sample projects tend to have more collaborators, are maintained for longer periods, and tend to be more focused on academic and scientific problems.

Mining Common Syntactic Patterns used by Java Programmers

Open source code repositories provide massive data as programs that have been used to develop different tools. These kinds of works have been included in the active Big Code and Mining Software Repositories research fields. Although different machine learning works already classify the syntactic constructs used by programmers, there are no reports about the most common syntactic patterns used by Java programmers. In this article, we describe a system we build to provide such a report. Our system retrieves the syntactic patterns used by Java programmers, distinguishing those utilized by experts and beginners. We also present the anomalies found in the usage of different syntactic constructs. We modify the OpenJDK compiler to double the syntactic information included in its Abstract Syntax Tree (AST), define a mechanism to translate ASTs into n-dimensional vectors, combine the information of different syntax constructs to build heterogeneous patterns, and apply the Frequent Pattern Growth algorithm to mine the syntactic patterns as association rules. The mined patterns allow expressing hierarchical subpatterns connected to one another, providing a high level of expressiveness.