# LLM-Driven CI-CD Workflow Intelligence for Cyber Systems Engineering

arXiv: https://arxiv.org/abs/2607.04579 · HTML: https://mlsanity.com/paper/2607.04579/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 11 of its 33 references that are in the map.
- First posted on arXiv 6 Jul 2026.

## Builds on (most cited first, 11 of 11)

- [A Survey on Large Language Models for Software Engineering](https://mlsanity.com/paper/2312.15223/) (2023)
- [Continuous Integration, Delivery and Deployment: A Systematic Review on Approaches, Tools, Challenges and Practices](https://mlsanity.com/paper/1703.07019/) (2017)
- [Towards Autonomous Testing Agents via Conversational Large Language Models](https://mlsanity.com/paper/2306.05152/) (2023)
- [On the effectiveness of Large Language Models for GitHub Workflows](https://mlsanity.com/paper/2403.12446/) (2024)
- [The Hidden Costs of Automation: An Empirical Study on GitHub Actions Workflow Maintenance](https://mlsanity.com/paper/2409.02366/) (2024)
- [Continuous integration in a social-coding world: Empirical evidence from GitHub. **Updated version with corrections**](https://mlsanity.com/paper/1512.01862/) (2015)
- [GitHub Actions: The Impact on the Pull Request Process](https://mlsanity.com/paper/2206.14118/) (2022)
- [Automatic Security Assessment of GitHub Actions Workflows](https://mlsanity.com/paper/2208.03837/) (2022)
- [Initial and Eventual Software Quality Relating to Continuous Integration in GitHub](https://mlsanity.com/paper/1606.00521/) (2016)
- [Continuous Integration and Software Quality: A Causal Explanatory Study](https://mlsanity.com/paper/2309.10205/) (2023)
- [On the Need to Monitor Continuous Integration Practices -- An Empirical Study](https://mlsanity.com/paper/2409.05101/) (2024)

## Abstract (arXiv)

CI/CD workflows have become executable operational policy: they decide what gets built, tested, released, and deployed, and they mediate how maintainers interact with delivery infrastructure. That makes them an important measurement point for cyber-systems engineering. Recent large language model (LLM) work shows that workflow stages can be recognized directly from configuration files, but stage labels alone do not tell us whether a workflow is brittle, unusual for its ecosystem, or worth revising first. We present an LLM-based CI/CD analysis pipeline that combines repository enrichment, anti-pattern detection, stage mining, and recommendation generation over a large GitHub corpus. Starting from 59,550 repositories with at least 1,000 stars, we identify 34,225 projects with CI/CD and collect 127,559 configuration files. Across 75,201 analyzed workflows, the anti-pattern detector reports 434,769 findings, dominated by reliability and maintainability issues. Across 59,906 configurations, stage usage differs significantly by language (chi2 = 4168.88, p < 0.001, Cramer's V = 0.063), and domain analysis shows distinct operational profiles, including higher release and cache usage in mobile projects. For repository-level recommendation generation, few-shot prompting performs best overall, averaging 8.25 recommendations per repository with 96.1% YAML-valid snippets. Taken together, the results argue for CI/CD observability that combines diagnosis, context, and human review rather than treating workflow mining as a stage-classification problem alone.