Model to reduce DevOps pipeline execution time using SAST
Open accessPublished version of a preprint
Abstract
Abstract Static code analysis (SAST is a well-known concept) to identify security flaws in the code to improve software product quality. A SAST tool called SonarQube which can scan source code of an application and identify the vulnerabilities present in software. It can also find the RCA of the vulnerabilities found in software products. it helps in rehabilitating the securities flaws found in analysis of the software products. SAST tools analyses upside-down for an application. It does not need s system to be in running state to perform analysis. The scan provides instant feedback to developers in terms of reducing security risks for an application. It helps to resolve issues which was present during development and helps developers to increase their knowledge. As a result, developers become competent about knowledge of security for software product. The sonar analysis report provides on demand access to all recommendations. The user can navigate to line-of-code which have vulnerabilities and they can do faster discovery and auditing. And hence the developers can write more code which is less vulnerable. This way they have more secure and quality product delivered. To conduct static analysis, the author(s) has used SonarQube as a tool, which compile and measure the code quality for the code kept in repositories. As Devops/DevSecOps standards, SonarQube is used to create different pipelines which normally increases the build pipeline execution time. In the proposed solution, the author(s) tried to reduce build pipeline execution time by conducting static analysis early Devops phases. Proposed solution uses GitHub open-source project written in C Sharp.Net language, Azure Devops, dotnet sonar scanner tool and SonarQube to conduct static analysis and testing. The authors(s) tried to enhance the software quality in early Devops phases which will be helpful in reducing the build time and cost. Proposed framework will be helpful in increasing reliability, efficiency, and performance of software project.
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Traditional SAST is often performed too late in the DevSecOps pipeline, resulting in build delays and increased project costs.
“The study highlights that traditional SAST is often performed too late in the DevSecOps pipeline, resulting in build delays and increased project costs.”
From Evolution of DevSecOps and Its Influence on Application Security: A Systematic Literature Review (2025) · cites this paper as [51]
The study's focus on specific tools may limit its generalisability to other environments or toolchains.
“The study's focus on specific tools may limit its generalisability to other environments or toolchains.”
From Evolution of DevSecOps and Its Influence on Application Security: A Systematic Literature Review (2025) · cites this paper as [51]
The findings of Saurabh & Kumar [51] are primarily based on tool-centric analysis and do not comprehensively address the organisational or process-related challenges of shifting SAST earlier in the pipeline.
“The findings of Saurabh & Kumar [51] are primarily based on tool-centric analysis and do not comprehensively address the organisational or process-related challenges of shifting SAST earlier in the pipeline.”
From Evolution of DevSecOps and Its Influence on Application Security: A Systematic Literature Review (2025) · cites this paper as [51]
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Cites
On a Test of Whether one of Two Random Variables is Stochastically Larger than the Other
Mann, H. B., & Whitney, D. R. (1947) · The Annals of Mathematical Statistics · doi:10.1214/aoms/1177730491 · Cited by 14,320 · see citing works
A Survey of DevOps Concepts and Challenges
Leite, L., Rocha, C., Kon, F., Milojicic, D., & Meirelles, P. (2020) · ACM Computing Surveys · doi:10.1145/3359981 · Cited by 484 · see citing works
Cliff´s Delta Calculator: A non-parametric effect size program for two groups of observations
Macbeth, G., Razumiejczyk, E., & Ledesma, R. D. (2010) · Universitas Psychologica · doi:10.11144/javeriana.upsy10-2.cdcp · Cited by 442 · see citing works
Challenges and solutions when adopting DevSecOps: A systematic review
Rajapakse, R. N., Zahedi, M., Babar, M. A., & Shen, H. (2022) · Information and Software Technology · doi:10.1016/j.infsof.2021.106700 · Cited by 235 · see citing works
Toward successful DevSecOps in software development organizations: A decision-making framework
Akbar, M. A., Smolander, K., Mahmood, S., & Alsanad, A. (2022) · Information and Software Technology · doi:10.1016/j.infsof.2022.106894 · Cited by 128 · see citing works
Continuous Delivery? Easy! Just Change Everything (Well, Maybe It Is Not That Easy)
Neely, S., & Stolt, S. (2013) · 2013 Agile Conference · doi:10.1109/agile.2013.17 · Cited by 124 · see citing works
The Top 10 Adages in Continuous Deployment
Parnin, C., Helms, E., Atlee, C., Boughton, H., Ghattas, M., Glover, A., Holman, J., Micco, J., Murphy, T. B., Savor, T., et al. (2017) · IEEE Software · doi:10.1109/ms.2017.86 · Cited by 87 · see citing works
Gupta, V., Kapur, P. K., & Kumar, D. (2017) · Information and Software Technology · doi:10.1016/j.infsof.2017.07.010 · Cited by 81 · see citing works
Rahman, M. T., Querel, L.-P., Rigby, P. C., & Adams, B. (2016) · International Conference on Mining Software Repositories (MSR) · doi:10.1145/2901739.2901745 · Cited by 73 · see citing works
Bahaa, A., Abdelaziz, A., Sayed, A., Elfangary, L., & Fahmy, H. (2021) · Information · doi:10.3390/info12040154 · Cited by 48 · see citing works
Software development with feature toggles: practices used by practitioners
Mahdavi-Hezaveh, R., Dremann, J., & Williams, L. A. (2021) · Empirical Software Engineering · doi:10.1007/s10664-020-09901-z · Cited by 47 · see citing works
Phillips, S., Sillito, J., & Walker, R. J. (2011) · International Workshop on Cooperative and Human Aspects of Software Engineering (CHASE) · doi:10.1145/1984642.1984645 · Cited by 46 · see citing works
Exploration of DevOps testing process capabilities: An ISM and fuzzy TOPSIS analysis
Rafi, S., Akbar, M. A., Wu, Y. C., Alsanad, A., Gumaei, A., & Sarwar, M. U. (2021) · Applied Soft Computing · doi:10.1016/j.asoc.2021.108377 · Cited by 33 · see citing works
TIPMerge: recommending experts for integrating changes across branches
Costa, C. D. S., Figueiredo, J., Murta, L., & Sarma, A. (2016) · ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering (ESEC/FSE) · doi:10.1145/2950290.2950339 · Cited by 30 · see citing works
Understanding predictive factors for merge conflicts
Dias, K. L. M. T. D., Borba, P. H. M., & Barreto, M. (2020) · Information and Software Technology · doi:10.1016/j.infsof.2020.106256 · Cited by 27 · see citing works
The modular and feature toggle architectures of Google Chrome
Rahman, M. T., Rigby, P. C., & Shihab, E. (2018) · Empirical Software Engineering · doi:10.1007/s10664-018-9639-0 · Cited by 25 · see citing works
Unifying Software and Product Configuration: A Research Roadmap
Hubaux, A., Jannach, D., Drescher, C., Murta, L., Männistö, T., Czarnecki, K., Heymans, P., Nguyen, T., & Zanker, M. (2012) · Cited by 19 · see citing works
Understanding Merge Conflicts and Resolutions in Git Rebases
Ji, T., Chen, L., Yi, X., & Mao, X. (2020) · Proceedings/Proceedings - International Symposium on Software Reliability Engineering · doi:10.1109/issre5003.2020.00016 · Cited by 18 · see citing works
Meinicke, J., Hoyos, J., Vasilescu, B., & Kästner, C. (2020) · International Conference on Mining Software Repositories (MSR) · doi:10.1145/3379597.3387463 · Cited by 11 · see citing works
On the Development of Feature-Based Sprint in AGILE
Sharma, S., & Kumar, D. (2019) · Advances in intelligent systems and computing · doi:10.1007/978-981-13-5934-7_20 · Cited by 5 · see citing works
Migration From DevOps to DevSecOps: A Complete Migration Framework, Challenges, and Evaluation
N., N. T., & Khandebharad, A. (2021) · International Journal of Cloud Applications and Computing · doi:10.4018/ijcac.2022010102 · Cited by 5 · see citing works
Predicting Suitable Agile Method Using Fuzzy AHP
Singh, R., Kumar, D., & Sagar, B. B. (2019) · Recent Advances in Computer Science and Communications · doi:10.2174/2213275912666191011154014 · Cited by 4 · see citing works
Requirement Barriers to Implement the Software Projects in Agile Development
Kumar, D., & Dhir, S. (2021) · Springer series in reliability engineering · doi:10.1007/978-3-030-78919-0_15 · Cited by 4 · see citing works
Flagged first, then by citations
1 of the 24 references couldn’t be matched to a known paper.
Research works printed but not linked: 11
- Sharma Sarika KD "Exploring Story Cards for Evaluating Requirement Understanding in Agile Software Development", Journal of Information Technology Management, Volume 14, pages 9- 22,2022 .
- Dai Q, Mao R, Huang H, Shen H, Shao D (2021) DevSecOps: Exploring Practices of Realising Continuous Security in DevOps (DevSecOps: DevOps). J Softw 32(10):3014-3035
- Donald E (1997) Kuth. The Art of Computer Programming, Volume 2 (3rd Ed.): Seminumerical Algorithms. AddisonWesley Longman Publishing Co., Inc., USA, ISBN 0201896842
- Kshitij Kumar. Dilemma of speed vs. scale in software system development best practices from industry leaders. Thesis, Massachusetts Institute of Technology (2017) URL http://dspace.mit.edu/handle/1721.1/ 110137
- Jens Meinicke J, Hoyos B, Vasilescu C, Kastner (2020) Capture the feature ag: Detecting feature ¨ ags in open-source. In International Conference on Mining Software Repositories, 22.
- Jens Meinicke J, Hoyos B, Vasilescu C, Kastner (2020) Capture the feature ag: Detecting feature ¨ ags in open-source. In International Conference on Mining Software Repositories, 23.
- Jens Meinicke J, Hoyos B, Vasilescu C, Kastner (2020) Capture the feature ag: Detecting feature ¨ ags in open-source. In International Conference on Mining Software Repositories, 24.
- Neely S, Stolt S (2013) Continuous Delivery? Easy! Just Change Everything (Well, Maybe It Is Not That Easy). In 2013 Agile Conference, pages 121-128, Nashville, TN, USA, doi: 10.1109/AGILE.2013.17 · DOI · Paper page
- Ramanathan MK, Clapp L (2020) Rajkishore Barik, and Manu Sridharan. Piranha: reducing feature ag debt at uber. In Proceedings of the ACM/IEEE 42nd International Conference on Software Engineering: Software Engineering in Practice, pages 221-230,
- Rembetsy M, McDonnell P. Continuously deploying culture: Scaling culture at etsy. Velocity Europe. O'Reilly (33), Erich F, Amrit C, Daneva M (2012) Report: Devops Literature Review, University of Twente, Tech. Rep, 2014
- Erich F, Amrit C, Daneva M (2011) Report: Devops Literature Review, University of Twente, Tech. Rep,
Cited by
Sorted by citations
Caniglia, A., Dentamaro, V., Galantucci, S., & Impedovo, D. (2025) · Information and Software Technology · doi:10.1016/j.infsof.2024.107605 · Cited by 18 · see citing works
Evolution of DevSecOps and Its Influence on Application Security: A Systematic Literature Review
Mohammed, K., Shanmugam, B., & El-Den, J. (2025) · Technologies · doi:10.3390/technologies13120548 · Cited by 8 · see citing works
Khadem, E. A., & Movaghar, A. (2025) · Array · doi:10.1016/j.array.2025.100547 · Cited by 10 · see citing works
Task Scheduling in Cloud Using Hybrid GA-PSO Model
Jonnalagadda, A., Sundaramoorthy, P., Panda, S., Rajamandrapu, A. K., Aggarwal, S., & Kulkarni, M. (2025) · Lecture notes in networks and systems · doi:10.1007/978-3-032-03558-5_32 · Cited by 2 · see citing works
Garcia, A. T. (2024) · Revista Científica y Tecnológica UPSE · doi:10.26423/rctu.v11i2.800
Research on the improvement of multi branch pipeline in solving large-scale practical problems
Shi, L., Qiao, H., Yang, C., Jiang, Y., & Long, B. (2025) · IEEE International Conference on Sensors, Electronics and Computer Engineering (ICSECE) · doi:10.1109/icsece65727.2025.11257123
Najib, W., Prabawisesa, A. D., & Adhipta, D. (2025) · International Conference on Awareness Science and Technology (iCAST) · doi:10.1109/icast68191.2025.11300153
Optimizing Software Testing with Machine Learning for Enhanced Quality Assurance in DevOps
Gan, L., Han, Z., Guo, J., Zhang, J., & Wu, Z. (2026) · Smart innovation, systems and technologies · doi:10.1007/978-3-032-13817-0_4
Benchmarking DevSecOps Pipelines: A Performance and Security Analysis of Laravel and CodeIgniter
Raihan, M. F., & Setiawan, H. (2025) · IEEE International Conference on Cryptography, Informatics, and Cybersecurity (ICoCICs) · doi:10.1109/icocics68032.2025.11383915
Chang, S., & Wang, Z. H. (2026) · International Conference on Artificial Intelligence and Industrial Technology Applications (AIITA) · doi:10.1109/aiita69518.2026.11567049
- Authors
- Saurabh, S. K., & Kumar, D.
- Affiliations
- Amity University (IN)
- Corresponding author
- Kumar, Deepak
- Venue
- International Journal of System Assurance Engineering and Management
- Published
- 2024-05
- Volume
- 15
- Issue
- 5
- Pages
- 1999-2009
- ISSN
- 0975-6809 (ISSN-L)
- 0976-4348
- OpenAlex
- W4399157174
- Cited by
- 10
- References
- 24
- Citations by year
- 2026: 2 · 2025: 6 · 2024: 2
- FWCI
- 3.74
- Type
- journal article
- Language
- en
- Open access
- green
- doi.org
- Licence
- Locations
- International Journal of Systems Assurance Engineering and Management (publishedVersion)
- Research Square (acceptedVersion, cc-by)
- RePEc: Research Papers in Economics (submittedVersion)
- Topics
- Physical Sciences › Computer Science › Information Systems › Software Engineering Techniques and Practices
- Physical Sciences › Computer Science › Information Systems › Web Application Security Vulnerabilities
- Physical Sciences › Computer Science › Information Systems › Software Engineering Research
- Keywords
- static application security testing, SonarQube, DevSecOps, DevOps pipelines, shift-left security, vulnerability detection, root cause analysis, C++, Azure DevOps, software quality
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
