Searcharxiv⌕ Search

arXiv subjects

Edward Abrokwah

Publications and source records attributed to Edward Abrokwah.

2 recordsLinked to original sources
arXiv2026

An Empirical Study of Complexity, Heterogeneity, and Compliance of GitHub Actions Workflows

Continuous Integration (CI) has become a core practice in modern software engineering, enabling rapid and collaborative software delivery. GitHub Actions (GHA) has become a leading CI platform due to its tight GitHub integration and growing ecosystem of reusable workflows. Despite extensive documentation and best practices, there is limited empirical understanding of how real-world GHA workflows align with recommended guidelines. This study analyzes the structure, complexity, heterogeneity, and compliance of GHA workflows across Java, Python, and C++ repositories. We (a) quantify workflow complexity, (b) identify recurring and diverse structural patterns, (c) evaluate compliance with best practices, and (d) compare workflow design across languages. GHA workflows are generally small, shallow, and heavily dependent on external actions, with limited sequence-level standardization despite recurring intent-level patterns. A common pipeline prefix appears in 39.5% of workflows, but workflow sequences are highly heterogeneous, with only one exceeding the 5% global frequency threshold. We observe that Java has the lowest explicit test adoption, Python follows canonical templates but shows weaker security practices, and C++ workflows are larger and more structurally diverse. Compliance gaps are widespread, especially in permissions, timeout configuration, and SHA pinning, while reusable workflows remain rare. Build-without-test patterns suggest that workflow design is driven more by ecosystem conventions and platform defaults than by best practices. This indicates that better defaults and tooling could improve workflow security, modularity, and maintainability, while researchers should account for language- and repository-level factors when analyzing CI systems. Overall, this work provides a reproducible empirical baseline for studying and improving GHA workflow design in open-source ecosystems.

cs.SE↗
arXiv2026

How Compliant Are GitHub Actions Workflows? A Checklist-Based Study with LLM-Assisted Auditing

GitHub Actions (GHA) CI workflows are critical infrastructure, but current tooling offers only syntactic or heuristic checks and does not enforce documented best practices for security, maintainability, or performance. Consequently, issues like over-privileged permissions, weak secrets management, and missing failure notifications remain undetected in real-world pipelines. This paper proposes a novel, documentation-grounded GHA compliance checklist with 30 criteria spanning four workflow sections and eight themes, and assesses Large Language Models (LLMs) for scalable compliance auditing. On 95 real-world Java workflows (2,850 assessments) using four open-weight LLMs, we find only fair agreement (Fleiss' kappa = 0.28), with systematic disagreement on structural reasoning and security-sensitive judgments. To address this, we introduce a multi-tier adjudication framework in which GPT 5 resolves model conflicts before targeted manual review, reducing verification effort by 81% while retaining 87% agreement with expert judgment. At scale, it reveals major compliance gaps: overall compliance is 28%, dropping to 4% for permission controls; Security (26%) lags far behind Clarity (68%). Our results show that LLMs enable scalable compliance measurement but cannot replace experts, highlighting the need for hybrid human-AI auditing and providing empirical benchmarks and guidance for defensible GHA workflow audits.

cs.SE↗