Automation analysis

[simcha-vos-from-tu-delft]

I'm with the Software Engineering Research Group at the TU Delft, and I am investigating automations. I have looked at your repository and which GitHub workflows and Maven plugins you are using. I hope to provide you with some interesting insights about your repository! I'll give you a quick summary of what I found, and the automation tasks I recommend you to focus on next (:

Level of maturity	Basic	Intermediate	Advanced
Collaboration	‎ ✅ Completed this level!
	✔️ Prepare or create documentation artifacts	✔️ Generate documentation from source code ❌ Bot commits	❌ Publish documentation ❌ Pre-commit hooks ❌ Issue or PR bots
Code quality	‎ ⚠️ Still working on this level!
	✔️ Run tests ❌ Static code style analysis	✔️ Test coverage and validity ✔️ Static code quality analysis ❌ Generate test reports ❌ Automatic code formatting	✔️ Verify packaging correctness ✔️ Sign artifacts ✔️ License checks ❌ Vulnerability scans
Development			‎ ✅ Completed this level!
	✔️ Build files configuration	✔️ Build environment configuration	✔️ Optimization
Artifacts		‎ ✅ Completed this level!
	✔️ Code compilation ✔️ Dependency management of artifact	✔️ Build tasks, resources and configuration ✔️ Packaging ✔️ Release tagging ✔️ Publish artifacts to a registry	✔️ Generate source and metadata artifacts ❌ Generate release notes ❌ Source control management ❌ Containerization

And now? Next steps!

It is not always clear which automation tasks should be prioritized. It is however important to balance your automation efforts, as a uniform level of maturity is most productive. I'm here to help! Below is a list of tasks that you can work on to help level up your maturity across the automation domains:

• Implement Static code style analysis; implemented by 9% of GitHub repositories
• Implement Automatic code formatting; implemented by 10% of GitHub repositories

What do you think?

Do you think my analysis is correct, do these recommendations help you? Or have I missed something?

For my master's thesis I'm doing research into the use of automations in GitHub repositories. With my findings, I want to see if I can help out developers with what automations they could focus on. Do you want to help me out? Leaving a response is much appreciated!

If you have any other Java/Maven projects you'd like analyzed, you can send me the repositories and I can analyze them for you!

[reckart]

INCEpTION has many tests, documentation, uses GitHub Actions for CI etc.

Please check your results.

[simcha-vos-from-tu-delft]

INCEpTION has many tests, documentation, uses GitHub Actions for CI etc.

Please check your results.

Hi @reckart, I've looked into it. I think you are running tests with mvn verify using surefire. But my code did not detect surefire as a plugin anywhere. I am also admittedly unsure if i should count mvn verify as running tests; since if you don't have any tests it will just skip it, and verify is also doing other things other than testing I imagine. I will however take that into consideration!
Cheers, Simcha

[reckart]

You'd need to check not only the repo itself but also the complete parent POM inheritance chain.

For best results, you might want to instrument the build and run a full build in order to check which plugins are executed with which configurations.

[simcha-vos-from-tu-delft]

Hi @reckart,

Ah, in this case I was unable to locate the parent POM, since it's not on Maven Central I believe. In these cases I've chosen to put the minimal POM as parent POM and create the effective POMs with that.

[reckart]

Sure the parent POM is on Maven Central: https://central.sonatype.com/artifact/org.dkpro/dkpro-parent-pom

[simcha-vos-from-tu-delft]

Sure the parent POM is on Maven Central: https://central.sonatype.com/artifact/org.dkpro/dkpro-parent-pom

Ah you're right, I was looking for the wrong thing, I have fixed it now and updated it!

I have one final question to help me better understand your interest in tools like this. Given that this tool would be detecting all your automations well, and perhaps it offers support for different types of projects, would you be interested in using it, as a way to easily report on your current state of automations and gain recommendations for future automation steps? For example, if its available as a badge in your readme or a GitHub workflow action?

Once again thanks a ton for your reply!!

[reckart]

I am adding additional tooling to my projects as they evolve. Not every project requires everything that your checklist mentions. So, no, I wouldn't use it. For me, tools like dependabot, scorecard.dev, vulnerability scanners, etc. are more interesting.

However, your tooling (if it works properly and can be flexibly configured) might be interesting to a tech-manager person in order to establish some quality baselines for the projects created by the team(s) that the manager manages.