ABSTRACTDevOps is a collaborative software development process where practitioners work as a team to continuously develop, deploy, and deliver software. DevOps practices still need to be mature, and practitioners face numerous challenges while considering DevOps as a software development process. The mainstream research community has helped simplify the DevOps adoption process and eliminate complexities by developing DevOps maturity models. However, the current maturity frameworks cannot measure every component of DevOps and do not mention metrics as parameters for measuring different DevOps practices or features. Therefore, this study aims to identify metrics for measuring practices and activities responsible for DevOps implementation. The systematic literature review (SLR) method was used to determine the metrics needed to measure DevOps practices. Using SLR, we have identified 32 metrics from 57 articles. The metrics identified in this study can be used to measure the impact of the practices adopted for DevOps implementation within software development organizations. Furthermore, we divided the identified metrics into Dev and Ops categories and five significant categories based on the DevOps lifecycle. The classification of metrics in our study into diverse regions provides a conceptual framework and understanding of DevOps measures.

Abstract In safety‐critical systems engineering, regulations such as Automotive SPICE, ISO26262, or ED‐109A mandate software quality assurance measures to provide evidence that the developed system is high quality. The constraints that define quality assurance conditions during the engineering life cycle are often non‐trivial. This paper addresses the challenges, engineers face who are unfamiliar with the precise constraints of various projects (e.g., when newly joining a company or switching between departments). Understanding how to fulfill a constraint is a time‐consuming and challenging task as an engineer needs to determine the most suitable option (out of potentially many) to fulfill a constraint violation. To this end, we propose a guidance action ranking framework to provide engineers with the most relevant guidance actions. Our primary ranking algorithm analyzes in the background the actions that engineers have made in the past to resolve a constraint violation without requiring explicit feedback from them. We evaluated our framework on two real‐world data sets: an open‐source drone management and an industrial air traffic control software system. Concretely, we replay past engineering activities and measured whether, in the case of a constraint violation, our suggested guidance actions were indeed selected by the engineer. The evaluation results revealed that learning from prior guidance actions effectively identifies the most appropriate guidance actions (ranked top 1 or 2) when compared to ranking algorithms based on action simplicity and artifact property change frequency. Specifically, we achieve a median MRR of 0.95 for the first case study and 0.94 for the second case study: an improvement of 80% and 100% over the baseline. Additionally, we observed that the simplicity of a guidance action does not reliably indicate its suitability for fulfilling a constraint, whereas learning from prior change operation property out‐performed simplicity‐based ranking but did not surpass guidance frequency‐based ranking.

The field of software refactoring has been evolving rapidly, driven by the need to maintain software quality and manage complexity as software systems grow. This special issue of the Journal of Software: Evolution and Process focuses on “Software Refactoring: Application Breadth and Technical Depth,” aiming to promote research that advances our understanding of software refactoring practices and their impact. The selected papers in this issue reflect the broad scope and technical depth of the topic, covering a variety of innovative methodologies, empirical studies, and new tools that push the boundaries of current software refactoring research. The paper “Software Refactoring Side Effects” by AbuHassan, Alshayeb, and Ghouti addresses the often-overlooked side effects of software refactoring. The authors propose three different approaches for handling these side effects and employ a multi-objective optimization algorithm to identify optimal refactoring decisions. Their work enhances the understanding of refactoring's unintended consequences and proposes practical solutions, fitting well into the theme of exploring new dimensions of refactoring practices. Zhao et al., in their article “An Architecture Refactoring Approach to Reducing Software Hierarchy Complexity,” introduce a novel metric to quantify software hierarchy complexity and propose the Complexity-oriented Software Architecture Refactoring (CoSSR) approach. Their study demonstrates how reducing software hierarchy complexity can improve software quality, aligning with the issue's focus on reducing complexity through innovative refactoring techniques. The article “MARS: Detecting Brain Class/Method Code Smell Based on Metric-Attention Mechanism and Residual Network” by Zhang and Dong presents a new method for detecting complex code smells using a novel deep learning approach. By leveraging a metric-attention mechanism and an improved residual network, their model shows superior performance compared to existing methods. This research contributes to the special issue by applying cutting-edge machine learning techniques to refactoring challenges. AlOmar et al.'s study, “Behind the Scenes: On the Relationship Between Developer Experience and Refactoring,” investigates the correlation between developer experience and refactoring activities across 800 open-source projects. Their findings highlight that experienced developers tend to perform more varied refactoring operations but document less of their refactoring activities. This study offers a new perspective on how human factors influence refactoring practices, enriching the broader conversation on effective software evolution. In “A Study of Refactorings During Software Change Tasks,” Eilertsen and Murphy explore the reasons behind the disuse of refactoring tools during software change tasks. Their observational study reveals that the strategies developers use significantly impact the use of refactoring tools, pointing to a gap between available tool support and actual developer needs. This paper provides valuable insights into the practical challenges of implementing refactoring in real-world settings. Halepmollasi and Tosun, in “Exploring the Relationship Between Refactoring and Code Debt Indicators,” present an empirical analysis of the association between different types of refactorings, code smells, and faults. Their findings challenge previous assumptions about refactoring's impact on code smells and suggest that refactoring activities might be more fault-inducing than previously thought. This research adds a critical dimension to understanding the effects of refactoring on software quality. Lastly, Abdou and Darwish's article, “Severity Classification of Software Code Smells using Machine Learning Techniques: A Comparative Study,” evaluates various machine learning models for classifying the severity of code smells. Their use of the LIME algorithm for model interpretability provides new insights into predicting code smell severity, contributing to the issue's exploration of data-driven approaches to software maintenance. Recent developments in generative AI and machine learning have opened new avenues for advancing software refactoring practices. As demonstrated by some of the studies in this issue, these technologies can automate and enhance refactoring processes, improve tool support, and provide more accurate code smell detection. The application of AI in this domain is still in its early stages, but it holds great promise for transforming how software systems are maintained and evolved. We encourage researchers to explore these emerging trends further, focusing on integrating AI-driven approaches with traditional software engineering practices. We extend our sincere appreciation to all the authors for their contributions, to the peer reviewers for their invaluable feedback and dedication, and to the editorial board members for their support in assembling this special issue. Together, these efforts have created a diverse collection of research that we believe will significantly impact the field of software refactoring.

No abstract is available for this article.

Abstract With the widespread application of smart contracts, there is a growing concern over the quality assurance of smart contracts. The data flow testing is an important technology to ensure the correctness of smart contracts. We propose an approach named IABC‐TCG (Improved Artificial Bee Colony‐Test Case Generation) to generate test cases for the data flow testing of smart contracts. With a dominance relations‐based fitness function, an improved artificial bee colony algorithm is used to generate test cases, in which the bee colony search coefficient is adaptively adjusted to improve the effectiveness and efficiency of the search. In addition, an improved test case selection and updation strategy is used to avoid unnecessary test cases. The experimental results show that IABC‐TCG achieves 100% coverage for all the test requirements on a dataset of 30 smart contracts and outperforms the baseline approaches in terms of the number of test cases and the execution time. Performing tests with the generated test cases, IABC‐TCG can find more errors with less test cost.

No abstract is available for this article.

Abstract Microservice architecture (MSA) is a mainstream architectural style due to its high maintainability and scalability. In practice, an appropriate microservice‐oriented decomposition is the foundation to make a system enjoy the benefits of MSA. In terms of decomposing monolithic systems into microservices, researchers have been exploring many optimization objectives, of which modularity is a predominantly focused quality attribute. Security is also a critical quality attribute, that measures the extent to which a system protects data from malicious access or use by attackers. Considering security in microservices‐oriented decomposition can help avoid the risk of leaking critical data and other unexpected software security issues. However, few researchers consider the security objective during microservice‐oriented decomposition, because the measurement of security and the trade‐off with other objectives are challenging in reality. To bridge this research gap, we propose a security‐optimized approach for microservice‐oriented decomposition (So4MoD). In this approach, we adapt five metrics from previous studies for the measurement of the data security of candidate microservices. A multi‐objective optimization algorithm based on NSGA‐II is designed to search for microservices with optimized security and modularity. To validate the effectiveness of the proposed So4MoD, we perform several experiments on eight open‐source projects and compare the decomposition results to other three state‐of‐the‐art approaches, that is, FoSCI, CO‐GCN, and MSExtractor. The experiment results show that our approach can achieve at least an 11.5% improvement in terms of security metrics. Moreover, the decomposition results of So4MoD outperform other approaches in four modularity metrics, demonstrating that So4MoD can optimize data security while pursuing a well‐modularized MSA.

Abstract Whenever an emergency occurs, such as a change in the system operating environment that prevents regular functioning, one possibility to restore the system to normal operation is to perform immediately the emergency repair process (ERP). This paper introduces the feature‐based emergency repair process (FbERP), which constitutes a feature‐based improvement/extension to ERP. FbERP uses feature models to represent urgent change requests (UCRs) and traces each change to its location in the code base in order to realign documentation and code. Based on real‐world change requests, we evaluated the proposed process using different techniques, including an empirical case study and a small survey. In the empirical case study, we compare FbERP with respect to ERP to check the effectiveness, efficiency, and usability of the proposed process. The results of the evaluation reveal that FbERP can be successfully used by software engineers to respond to UCRs, with an improvement over ERP.

Abstract“Shift To Left” is the cornerstone of the successful implementation of DevSecOps. By testing projects for vulnerabilities in the early stages of development, teams can save overall costs before security issues reach the build phase. As one of the popular practices in “Shift To Left,” the Software Composition Analysis (SCA) system aims to leverage the Software Bill of Materials (SBOM) to enhance software supply chain security. However, the SBOM lacks mature generation and distribution mechanisms, requiring incentive measures to drive industry consensus. Additionally, the data and tools associated with the SBOM lack effective record‐keeping and monitoring, making it challenging to ensure data integrity and tool security. Traditional SCA systems treat SBOM as a regular data format for external service provision, yet fail to solve problems such as lack of shared platforms, inability to guarantee data integrity and tool security, as well as issues with poor interoperation compatibility. This paper introduces blockchain technology into the SCA system, utilizing smart contracts to provide core SBOM tool services and microservices to improve the operational efficiency of smart contract deployment and maintenance. The proposed SCA system effectively provides a shared platform for SBOM with reliable data integrity, guaranteed tool security, and good interoperability.

Abstract Third‐party software has streamlined the software engineering process, allowed software engineers to focus on developing more advanced components, and reduced time and cost. This shift has led to software development strategies moving from competition to collaboration, resulting in the concept of software ecosystems, in which internal and external actors work together on shared platforms and place their trust in the ecosystem. However, the increase in shared components has also created challenges, especially in security, as the large dependency trees significantly enlarge a system's attack surface. The situation is made worse by the lack of effective ways to measure and ensure the trustworthiness of these components. In this article, we explore current approaches used to evaluate trust in software ecosystems, focusing on analyzing the specific techniques utilized, the primary factors in trust evaluation, the diverse formats for result presentation, as well as the software ecosystem entities considered in the approaches. Our goal is to provide the status of current trust evaluation approaches, including their limitations. We identify key challenges, including the limited coverage of software ecosystem entities; the objectivity, universality, and environmental impacts of the evaluation approaches; the risk assessment for the evaluation approaches; and the security attacks posed by trust evaluation in these approaches.