CAREER: Analysis and Repair of Build Scripts for DevOps Software Practice

DevOps是一种将软件开发(Dev)与信息技术运营(Ops)相结合的软件开发方法。DevOps的目标是通过缩短软件开发生命周期来提高软件生产率和可靠性，同时提供与业务目标紧密一致的功能、修复和更新。采用DevOps方法的关键是自动化软件配置、构建、测试和部署的整个过程，以便在任何软件代码更改后都可以执行。这种自动化要求开发人员编写全面而复杂的构建脚本，并频繁地进行维护。由于构建脚本通常由不同的代码组件组成，并且对系统环境具有显著的依赖性和影响，因此它们对传统的代码分析、缺陷检测和修复技术提出了独特的挑战。该项目的目标是支持构建脚本的维护和质量保证的一套集成技术，以便开发人员对其构建脚本的信心水平与对其源代码的信心程度相似。如果成功，该项目将带来更高质量的构建脚本、更有成效的构建脚本维护、软件集成过程中更少的延误以及更强大的软件产品，特别是对于那些支持不同系统环境和配置的软件产品。该项目还将根据对构建脚本的分析，为流行的软件框架开发设置教程，以帮助新手软件开发人员学习这些框架。为了克服分析和修复构建脚本的挑战，该项目将开发(1)构建脚本的共生分析，它使构建过程能够在不同的系统环境和配置下执行，(2)基于共生分析期间收集的数据的部分静态分析，以检测未探索路径中的缺陷，以及(3)通过从具有类似构建配置的软件项目中学习脚本修订来修复构建失败的技术。在上述技术的开发过程中，该项目预计将通过四种方式推进知识边界。首先，它将导致对软件构建实践和常见故障的更好理解。其次，为了解决系统与环境的相关性和影响，该项目将提供关于构建脚本如何与系统环境交互的全面知识，并开发新的符号运算符、约束解算器和抽象，以支持共生和静态分析中的系统环境状态。第三，为了解决代码异构性，该项目将揭示构建脚本不同组件之间的共同关联模式，并开发新的算法，通过动态分析跨脚本边界传输符号表达式和静态分析结果。第四，该项目将研究不同项目的构建脚本修订、系统环境、配置和构建日志之间的冗余，并开发总结常见修复模板的技术。该奖项反映了NSF的法定使命，并通过使用基金会的智力优势和更广泛的影响审查标准进行评估，被认为值得支持。

DevOps is a software development methodology that combines software development (Dev) with information technology operations (Ops). The goal of DevOps is to enhance software productivity and reliability by shortening the software development life cycle while delivering features, fixes, and updates in close alignment with business objectives. The key to adopt the DevOps methodology is to automate the whole process of software configuration, build, testing, and deployment, so that they can be performed after any software code changes. Such automation requires developers to write comprehensive and complicated build scripts and maintain them frequently. Since build scripts often consist of heterogeneous code components and have significant dependency and impact on system environments, they raise unique challenges to traditional code analysis, defect detection, and repair techniques. This project targets an integrated suite of techniques supporting maintenance and quality assurance of build scripts, so that developers may have a similar level of confidence on their build scripts as on their source code. If successful, the project will lead to higher-quality build scripts, more productive build script maintenance, fewer delays in software integration process, as well as more robust software products, especially for those supporting different system environments and configurations. The project will also develop set-up tutorials for popular software frameworks based on analysis of their build scripts to help novice software developers learning the frameworks. To overcome the challenges on analyzing and repairing build scripts, the project will develop (1) concolic analysis of build scripts which enables executions of build process under different system environments and configurations, (2) partial static analyses based on data collected during concolic analysis to detect defects in unexplored paths, and (3) techniques to repair build failures by learning script revisions from software projects with similar build configurations. During the development of above techniques, the project is expected to advance knowledge boundary in four ways. First, it will lead to better understanding of software build practice and common failures. Second, to address system-environment dependencies and impacts, the project will provide comprehensive knowledge on how build scripts interact with system environments, and develop novel symbolic operators, constraint solvers, and abstractions to support system-environment states in concolic and static analyses. Third, to address code heterogeneity, the project will reveal common correlation patterns among different components of build scripts and develop novel algorithms to transfer symbolic expressions and static analysis results across script boundaries via dynamic analyses. Fourth, the project will study the redundancy among build scripts revisions, system environments, configurations, and build logs from different projects, and develop techniques on summarizing common repair templates.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.