一句话：通过分析 GitHub 问题并使用静态分析工具 Sniffer，实证揭示构建脚本中 13 类代码坏味及其流行与共现模式。
构建脚本用于编译、依赖管理、测试和打包，但开发者可能无意引入代码坏味，导致构建失败和技术债。本文采用混合方法：先定性分析 2000 个构建脚本相关 GitHub issue，归纳坏味类别；再开发静态分析工具 Sniffer，检测来自 4877 个开源仓库的 5882 个 Maven、Gradle、CMake 和 Make 脚本，并通过用户研究评估其精度、召回率和 F 值。研究识别出 13 类坏味、共 10,895 次出现（Maven 3184、Gradle 1214、CMake 337、Makefile 6160）。Maven 中最常见的是不安全 URL，Gradle/CMake 中常见硬编码路径/URL，Makefile 中常见通配符使用；共现分析揭示硬编码路径/URL 与重复、依赖管理不一致与空/不完整标签之间的强关联。最后提出消除坏味的建议。
Build scripts automate the process of compiling source code, managing dependencies, running tests, and packaging software into deployable artifacts. These scripts are ubiquitous in modern software development pipelines for streamlining testing and delivery. While developing build scripts, practitioners may inadvertently introduce code smells, which are recurring patterns of poor coding practices that may lead to build failures or increase risk and technical debt. The goal of this study is to aid practitioners in avoiding code smells in build scripts through an empirical study of build scripts and issues on GitHub. We employed a mixed-methods approach, combining qualitative and quantitative analysis. First, we conducted a qualitative analysis of 2000 build-script-related GitHub issues to understand recurring smells. Next, we developed a static analysis tool, Sniffer, to automatically detect code smells in 5882 build scripts of Maven, Gradle, CMake, and Make files, collected from 4877 open-source GitHub repositories. To assess Sniffer’s performance, we conducted a user study, where Sniffer achieved higher precision, recall, and F-score. We identified 13 code smell categories, with a total of 10,895 smell occurrences, where 3184 were in Maven, 1214 in Gradle, 337 in CMake, and 6160 in Makefiles.Our analysis revealed that Insecure URLs were the most prevalent code smell in Maven build scripts, while Hardcoded Paths/URLs were commonly observed in both Gradle and CMake scripts. Wildcard Usage emerged as the most frequent smell in Makefiles. The co-occurrence analysis revealed strong associations between specific smell pairs of Hardcoded Paths/URLs with Duplicates, and Inconsistent Dependency Management with Empty or Incomplete Tags, which indicate potential underlying issues in the build script structure and maintenance practices. Based on our findings, we also recommended strategies to remove code smells in build scripts to improve the efficiency, reliability, and maintainability of software projects.
@inproceedings{paperbot9392,
title = {Your Build Scripts Stink: The State of Code Smells in Build Scripts},
author = {Mahzabin Tamanna and Yash Chandrani and Matthew Burrows and Brandon Wroblewski and Laurie Williams and Dominik Wermke},
booktitle = {ASE},
year = {2025},
doi = {10.1109/ase63991.2025.00246}
}