LLM驱动的网络安全CI/CD工作流智能分析管线

Q: 为什么CI/CD工作流对网络系统工程很关键？

CI/CD工作流承载可执行的运行策略，决定构建、测试、发布与部署规则，并影响可靠性、安全性、发布节奏与基础设施成本等关键工程结果。

Q: 文中提出的LLM分析管线包含哪些主要步骤？

管线包含仓库增强（元数据补全）、反模式检测、阶段挖掘，以及对单个仓库生成可操作的推荐建议。

Q: 在自动生成CI/CD建议方面，哪种提示策略效果最好？

few-shot prompting整体表现最佳，平均每个仓库生成8.25条建议，且96.1%的片段满足YAML语法可用性；迭代式提示会更偏向输出关键问题。

Jul 16, 2026

Upload by Aria

CI/CD工作流被视为可执行的运行策略：它们决定构建、测试、发布与部署做什么，并塑造维护者与交付基础设施的交互方式。该工作面向网络系统工程的可观测性问题，指出仅靠工作流阶段标签无法判断脆弱性、生态异常性及优先级修订价值。作者提出基于LLM的CI/CD分析管线：仓库增强、反模式检测、阶段挖掘与推荐生成。结果覆盖59,550个星标仓库、75,201个工作流与434,769条反模式发现，阶段使用在语言间显著差异，few-shot在生成可校验建议上表现最佳。

LanguageEnglish

CategoryResearch & Report

FormatPDF

Pages6

Reading Time15 min

AccessFree to download

Abstract

I. INTRODUCTION

LLM-Driven CI/CD Workflow Intelligence for Cyber Systems Engineering Bonan Shen 1 , Jiazhou Gao2 Tao Ning3 , Wei-Jung Huang4 and Xin Liu5 arXiv :2607 .04579v 1 [ cs . SE] 6 Jul 2026 Abstract—CI/CD workflows have become executable operational policy: they decide what gets built, tested, released, and deployed, and they mediate how maintainers interact with delivery infrastructure. That makes them an important measurement point for cyber-systems engineering. Recent large language model (LLM) work shows that workflow stages can be recognized directly from configuration files, but stage labels alone do not tell us whether a workflow is brittle, unusual for its ecosystem, or worth revising first. We present an LLM-based CI/CD analysis pipeline that combines repository enrichment, anti-pattern detection, stage mining, and recommendation generation over a large GitHub corpus. Starting from 59,550 repositories with at least 1,000 stars, we identify 34,225 projects with CI/CD and collect 127,559 configuration files. Across 75,201 analyzed workflows, the anti-pattern detector reports 434,769 findings, dominated by reliability and maintainability issues. Across 59,906 configurations, stage usage differs significantly by language (χ2 = 4168 .88, p < 0.001, Cramer’s V = 0 .063), and domain analysis shows distinct operational profiles, including higher release and cache usage in mobile projects. For repository-level recommendation generation, fewshot prompting performs best overall, averaging 8.25 recommendations per repository with 96.1% YAML-valid snippets. Taken together, the results argue for CI/CD observability that combines diagnosis, context, and human review rather than treating workflow mining as a stage-classification problem alone. I. INTRODUCTION CI/CD configuration files do more than automate builds. They decide which checks gate a merge, how failures are bounded, when artifacts are published, and what paths lead to deployment. In other words, they encode operational policy. For software-intensive systems, that policy has direct consequences for reliability, security, release cadence, and infrastructure cost. Recent work has shown that LLMs can recover common CI/CD stages directly from raw workflow files at scale [1] . Useful as that result is, it still leaves the main engineering questions open: Which workflows look fragile? What counts as normal for a given ecosystem? Which fixes are worth a maintainer’s time? We study those questions by treating CI/CD workflows as analyzable infrastructure rather than passive configuration text. Our pipeline begins with a large GitHub corpus, enriches repositories with language and domain metadata, scans workflows for anti-patterns and stage structure, and then generates repository-level recommendations with sev- 1 Independent Researcher [shenbonan2@gmail.com](shenbonan2@gmail.com) [2](2 Independent Researcher gjz140103@gmail.com)[ Independent Researcher](2 Independent Researcher gjz140103@gmail.com)[ gjz140103@gmail.com](2 Independent Researcher gjz140103@gmail.com) [3](3 Independent Researcher ntgd1102@gmail.com)[ Independent Researcher](3 Independent Researcher ntgd1102@gmail.com)[ ntgd1102@gmail.com](3 Independent Researcher ntgd1102@gmail.com) [4](4 Independent Researcher william.wj.huang@gmail.com)[ Independent Researcher](4 Independent Researcher william.wj.huang@gmail.com)[ william.wj.huang@gmail.com](4 Independent Researcher william.wj.huang@gmail.com) 5 Independent Researcher [iamxinliu@gmail.com](iamxinliu@gmail.com) | Prompting comparison validity analysis | Language significance domain stage profiles | | --- | --- | Fig. 1. Study overview. The artifact extends CI/CD analysis from coarse stage recognition to a connected pipeline that enriches repositories, mines anti-patterns and stages, and generates actionable repair suggestions. eral prompting strategies. The goal is not to replace maintainers with an autonomous fixer. The goal is to give them a cl

FAQs

为什么CI/CD工作流对网络系统工程很关键？

CI/CD工作流承载可执行的运行策略，决定构建、测试、发布与部署规则，并影响可靠性、安全性、发布节奏与基础设施成本等关键工程结果。

文中提出的LLM分析管线包含哪些主要步骤？

管线包含仓库增强（元数据补全）、反模式检测、阶段挖掘，以及对单个仓库生成可操作的推荐建议。

在自动生成CI/CD建议方面，哪种提示策略效果最好？

few-shot prompting整体表现最佳，平均每个仓库生成8.25条建议，且96.1%的片段满足YAML语法可用性；迭代式提示会更偏向输出关键问题。

Jul 16, 2026

Upload by Aria