Build It Clean: Large-Scale Detection of Code Smells in Build Scripts

• URL: http://arxiv.org/abs/2506.17948v1
• Date: Sun, 22 Jun 2025 09:01:42 GMT
• Title: Build It Clean: Large-Scale Detection of Code Smells in Build Scripts
• Abstract summary: Insecure URLs were the most prevalent code smell in Maven build scripts, while Hardcoded Paths/URLs were commonly observed in both Gradle and CMake scripts.<n>Based on our findings, we recommend strategies to mitigate the existence of code smells in build scripts to improve the efficiency, reliability, and maintainability of software projects.
• Score: 7.553917924788079
• License: http://creativecommons.org/licenses/by-nc-nd/4.0/
• Abstract: Build scripts are files that automate the process of compiling source code, managing dependencies, running tests, and packaging software into deployable artifacts. These scripts are ubiquitous in modern software development pipelines for streamlining testing and delivery. While developing build scripts, practitioners may inadvertently introduce code smells. Code smells are recurring patterns of poor coding practices that may lead to build failures or increase risk and technical debt. The goal of this study is to aid practitioners in avoiding code smells in build scripts through an empirical study of build scripts and issues on GitHub. We employed a mixed-methods approach, combining qualitative and quantitative analysis. We conducted a qualitative analysis of 2000 build-script-related GitHub issues. Next, we developed a static analysis tool, Sniffer, to identify code smells in 5882 build scripts of Maven, Gradle, CMake, and Make files, collected from 4877 open-source GitHub repositories. We identified 13 code smell categories, with a total of 10,895 smell occurrences, where 3184 were in Maven, 1214 in Gradle, 337 in CMake, and 6160 in Makefiles. Our analysis revealed that Insecure URLs were the most prevalent code smell in Maven build scripts, while Hardcoded Paths/URLs were commonly observed in both Gradle and CMake scripts. Wildcard Usage emerged as the most frequent smell in Makefiles. The co-occurrence analysis revealed strong associations between specific smell pairs of Hardcoded Paths/URLs with Duplicates, and Inconsistent Dependency Management with Empty or Incomplete Tags, indicating potential underlying issues in the build script structure and maintenance practices. Based on our findings, we recommend strategies to mitigate the existence of code smells in build scripts to improve the efficiency, reliability, and maintainability of software projects.

Related papers

• SpecMine: A Large-Scale Corpus of Spec-Driven Development Artifacts [7.933620345044633]
  SpecMine captures Spec-Driven Development (SDD) in public GitHub repositories.<n>It lets the community study, for the first time, how software is specified in the age of AI agents.
  arXiv  Detail & Related papers  (2026-08-25T22:43:30Z)
• Tencent WorkBuddy Bench: A Multi-Domain Coding-Agent Benchmark with Contamination-Resistant Task Construction [57.138342889101345]
  Tencent WorkBuddy Bench is a multi-domain evaluation suite for coding agents.<n>This report documents its construction methodology, scoring protocol, and a cross-model leaderboard.
  arXiv  Detail & Related papers  (2026-07-23T04:34:06Z)
• Configuration Smells in AGENTS.md Files: Common Mistakes in Configuring Coding Agents [0.3298597939573778]
  We present the first catalog of smells for coding-agent configuration files.<n>To identify such smells, we first conducted a grey literature review and a repository mining analysis.<n>Our results show that configuration smells are widespread. Lint Leakage was the most common smell, affecting 62% of the files.
  arXiv  Detail & Related papers  (2026-06-14T14:07:09Z)
• An Event-Driven Tool for Context-Aware Code Smell Detection Using SmellDSL [0.5424799109837065]
  Code smells signal violations of design principles that degrade the internal quality of evolving software systems.<n>SmellHunter is a context-aware tool that interprets scripts written in the Smell domain-specific language to detect and code smells.<n>SmellHunter is integrated into the development environment via a dedicated plugin and provides aggregated insights via a mobile application.
  arXiv  Detail & Related papers  (2026-05-20T03:43:32Z)
• SmellBench: Evaluating LLM Agents on Architectural Code Smell Repair [1.6922906233636834]
  Architectural code smells erode software maintainability and are costly to repair manually.<n>We present the first empirical evaluation of large language model agents on architectural code smell repair.<n>We contribute SmellBench, a task orchestration framework that incorporates smell-type-specific optimized prompts.
  arXiv  Detail & Related papers  (2026-05-07T22:33:32Z)
• PhantomRun: Auto Repair of Compilation Errors in Embedded Open Source Software [2.64399132991614]
  We study four major open-source embedded system projects, spanning over 4000 build failures from the project's CI runs.<n>We find that hardware dependencies account for the majority of compilation failures, followed by syntax errors and build-script issues.<n>We present PhantomRun, an automated framework that leverages large language models (LLMs) to generate and validate fixes for CI compilation failures.
  arXiv  Detail & Related papers  (2026-02-23T19:13:22Z)
• Characterizing Build Compromises Through Vulnerability Disclosure Analysis [9.08445613708978]
  This paper presents an empirically-derived taxonomy of attack vectors targeting the build process.<n>We categorize attack vectors by their injection points across the build pipeline, from source code manipulation to compiler compromise.<n>Our analysis reveals that 23.8% of supply chain attacks exploit build vulnerabilities, with dependency confusion and build script injection representing the most prevalent vectors.
  arXiv  Detail & Related papers  (2025-11-03T09:44:53Z)
• SwingArena: Competitive Programming Arena for Long-context GitHub Issue Solving [90.32201622392137]
  We present SwingArena, a competitive evaluation framework for Large Language Models (LLMs)<n>Unlike traditional static benchmarks, SwingArena models the collaborative process of software by pairing LLMs as iterations, who generate patches, and reviewers, who create test cases and verify the patches through continuous integration (CI) pipelines.
  arXiv  Detail & Related papers  (2025-05-29T18:28:02Z)
• Attestable builds: compiling verifiable binaries on untrusted systems using trusted execution environments [3.207381224848367]
  attestable builds provide strong source-to-binary correspondence in software artifacts.<n>We tackle the challenge of opaque build pipelines that disconnect the trust between source code and the final binary artifact.
  arXiv  Detail & Related papers  (2025-05-05T10:00:04Z)
• Paper2Code: Automating Code Generation from Scientific Papers in Machine Learning [57.09163579304332]
  We introduce PaperCoder, a framework that transforms machine learning papers into functional code repositories.<n>PaperCoder operates in three stages: planning, designs the system architecture with diagrams, identifies file dependencies, and generates configuration files.<n>We then evaluate PaperCoder on generating code implementations from machine learning papers based on both model-based and human evaluations.
  arXiv  Detail & Related papers  (2025-04-24T01:57:01Z)
• CLOVER: A Test Case Generation Benchmark with Coverage, Long-Context, and Verification [71.34070740261072]
  This paper presents a benchmark, CLOVER, to evaluate models' capabilities in generating and completing test cases.<n>The benchmark is containerized for code execution across tasks, and we will release the code, data, and construction methodologies.
  arXiv  Detail & Related papers  (2025-02-12T21:42:56Z)
• An Empirical Study of Dotfiles Repositories Containing User-Specific Configuration Files [1.7556600627464058]
  Hundreds of thousands choose to publicly host their repositories on GitHub.<n>We collected and analyzed publicly-hosted dotfiles repositories on GitHub.<n>We found that 25.8% of the top 500 most-starred GitHub users maintain some form of publicly accessible dotfiles repository.
  arXiv  Detail & Related papers  (2025-01-30T18:32:46Z)
• Commit0: Library Generation from Scratch [77.38414688148006]
  Commit0 is a benchmark that challenges AI agents to write libraries from scratch.<n>Agents are provided with a specification document outlining the library's API as well as a suite of interactive unit tests.<n> Commit0 also offers an interactive environment where models receive static analysis and execution feedback on the code they generate.
  arXiv  Detail & Related papers  (2024-12-02T18:11:30Z)
• Understanding Code Understandability Improvements in Code Reviews [79.16476505761582]
  We analyzed 2,401 code review comments from Java open-source projects on GitHub. 83.9% of suggestions for improvement were accepted and integrated, with fewer than 1% later reverted.
  arXiv  Detail & Related papers  (2024-10-29T12:21:23Z)
• MoCo: Fuzzing Deep Learning Libraries via Assembling Code [13.937180393991616]
  Deep learning techniques have been applied in software systems with various application scenarios. DL libraries serve as the underlying foundation for DL systems, and bugs in them can have unpredictable impacts. We propose MoCo, a novel fuzzing testing method for DL libraries via assembling code.
  arXiv  Detail & Related papers  (2024-05-13T13:40:55Z)
• RepoCoder: Repository-Level Code Completion Through Iterative Retrieval and Generation [96.75695811963242]
  RepoCoder is a framework to streamline the repository-level code completion process. It incorporates a similarity-based retriever and a pre-trained code language model. It consistently outperforms the vanilla retrieval-augmented code completion approach.
  arXiv  Detail & Related papers  (2023-03-22T13:54:46Z)
• CoCoMIC: Code Completion By Jointly Modeling In-file and Cross-file Context [82.88371379927112]
  We propose a framework that incorporates cross-file context to learn the in-file and cross-file context jointly on top of pretrained code LMs. CoCoMIC successfully improves the existing code LM with a 33.94% relative increase in exact match and a 28.69% relative increase in identifier matching for code completion when the cross-file context is provided.
  arXiv  Detail & Related papers  (2022-12-20T05:48:09Z)
• Empirical Analysis on Effectiveness of NLP Methods for Predicting Code Smell [3.2973778921083357]
  A code smell is a surface indicator of an inherent problem in the system. We use three Extreme learning machine kernels over 629 packages to identify eight code smells. Our findings indicate that the radial basis functional kernel performs best out of the three kernel methods with a mean accuracy of 98.52.
  arXiv  Detail & Related papers  (2021-08-08T12:10:20Z)
• The Prevalence of Code Smells in Machine Learning projects [9.722159563454436]
  static code analysis can be used to find potential defects in the source code, opportunities, and violations of common coding standards. We gathered a dataset of 74 open-source Machine Learning projects, installed their dependencies and ran Pylint on them. This resulted in a top 20 of all detected code smells, per category.
  arXiv  Detail & Related papers  (2021-03-06T16:01:54Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.