The number of mobile applications has increased tremendously over the last decade, thereby also having increased the importance of mobile application testing. Testing is a very crucial process in the development of a mobile application to ensure reliability and proper functionality. In an Agile/DevOps environment, test automation is an integral part in order to support the continuous integration and continuous delivery/deployment principle. There is a plethora of mobile application testing automation frameworks available in the market today. Android testing frameworks were chosen for this study because of the prevalence of Android applications in the market today. The focus of this study is the comparison of the most popular mobile application testing automation frameworks in terms of performance and capabilities in an Agile/DevOps environment. In order to achieve this, firstly, the three most popular mobile application testing automation frameworks to be used for the study were identified. Secondly, the Key Performance Indicators and capabilities to be used for comparison of the frameworks were identified. Then, test cases in a complex mobile application were designed for analysing the frameworks based on the criteria gathered. Finally, the test cases were integrated in a Continuous Integration/ Continuous Delivery pipeline to gather results and perform a more detailed comparison in an Agile/DevOps environment. From this study, Espresso turned out to be the best framework in terms of KPI analysed beating the other frameworks in all the KPIs, while Robotium was second best followed by Appium. But on the other hand, Appium was the best framework in terms of capabilities by having ability to execute the maximum number of capabilities analysed followed by Robotium while Espresso was the worst framework in this criteria. / Antalet mobilapplikationer har ökat enormt under det senaste decenniet och därmed har även vikten av mobilapplikationstest ökat. Testning är en mycket viktig process i utvecklingen av en mobilapplikation för att säkerställa tillförlitlighet och korrekt funktionalitet. I en Agile/DevOps miljö är testautomation en viktig del för att stödja principen av kontinuerlig integration och kontinuerlig leverans/driftsättning. Det finns en mängd ramverk för automatiserad testning av mobilapplikationer på marknaden idag. Testramverk för Android valdes för denna studie på grund av utbredningen av Android-applikationer på marknaden idag. Fokus för denna studie är jämförelsen av de mest populära automatiserade testramverk för mobilapplikationer med avseende på prestanda och lämplighet i en Agile/DevOps miljö. För att uppnå detta, identifierades först de tre mest populära automatiserade testramverk för mobilapplikationer som skulle användas för studien. Sedan identifierades de viktigaste resultatindikatorerna och kapaciteterna som skulle användas för att jämföra ramverken. Därefter designades testfall i en komplex mobilapplikation för att analysera ramverken baserat på de bestämda kriterierna. Slutligen integrerades testfallen i en pipeline för kontinuerlig integration /kontinuerlig leverans för att samla resultat och utföra en mer detaljerad jämförelse i en Agile/DevOps miljö. Från denna studie visade sig Espresso vara det bästa ramverket när det gäller KPI-analys, som slog de andra ramarna i alla KPI: er, medan Robotium var näst bäst följt av Appium. Men å andra sidan var Appium det bästa ramverket med avseende på kapacitet. Den hade förmågan att utföra det maximala antalet kapacitet som analyserades, följt av Robotium medan Espresso var det sämsta ramverket i dessa kriterier.

DevSecOps emerged to mitigate the challenges of integrating security into DevOps. DevOps have grown tremendously, leading to difficulties in integrating security tools in its development process while maintaining speed and agility. This study aims to investigate the security tools in DevSecOps and how they have been reported in previous literature. The main objective of this study is to provide a knowledge base concerning security tools in DevSecOps that can be used to mitigate challenges regarding the selection and use of security tools in the context of DevSecOps. A systematic literature review was adopted for the research. The study collected a total of  228 studies published between 2015 and 2022; fourteen of these papers were selected to be used for data extraction after conducting a thorough review protocol. This study has identified thirteen security tool categories used or recommended to be used in DevSecOps. These tools have been structured into seven phases of the development process and five security practices. Additionally, this study has identified twelve drawbacks and sixteen recommendations concerning the use of these security tools in DevSecOps.  The security tools categories, recommendations, and drawbacks identified in this study could potentially be used to facilitate the challenges of selecting and using security tools in DevSecOps and similar methodologies that rely on automation and delivering software frequently.

There is a great demand for fast deliveries of improved and updated software in different software development areas, like Internet of Things, web, and cloud, in today’s digitalized world. Software developers and organizations must adapt to be able to deliver according to customers’ wishes, to be able to retain them, and remain competitive with other organizations. Continuous integration and continuous delivery (CI/CD) are methods used within the software development world, allowing developers to automate parts of their work to develop and deliver software faster and with better quality. Tools used for CI/CD come with different benefits and performances making it difficult for developers to choose a tool. There are numerous tools to choose from, and there is a lack of performance comparisons of them. This thesis aims to give developers a performance comparison between the two well-known CI/CD tools, GitHub Actions and Jenkins, to facilitate their choice of a CI/CD tool. The research was qualitative, inductive, and comparative. A literature study and practical tests were conducted to study the performance differences between the two wellknown CI/CD tools, GitHub Actions and Jenkins. The literature study was conducted f irst and gave the necessary knowledge to perform the practical tests, and the practical tests gave the actual results. The practical tests were performed on two different software projects ,and two different tests per projec, per server were conducted. The results from both projects indicated apparent differences in performance between GitHub Actions and Jenkins, as Jenkins ran faster than GitHub Actions while running on a Windows server, and GitHub Actions ran faster than Jenkins while running on an Ubuntu server. These findings indicate that the two well-known CI/CD tools perform differently depending on the server the developers would use these tools. It can not be concluded that one of the tools has better performance than the other; instead, one tool has better performance depending on the operating system the tool is running on. If the developers were to use the tools on an Ubuntu server, GitHub Actions would be the preferred tool, and if they were to use the tool on a Windows server, Jenkins would be the preferred tool. / Det finns en stor efterfrågan på snabba leveranser av förbättrad och uppdaterad mjukvara i olika mjukvaruutvecklings områden så som Sakernas Internet, webb och moln i dagens digitaliserade värld. Mjukvaruutvecklare och organisationer måste anpassa sig för att kunna leverera till kundernas önskemål för att kunna behålla dom och förbli konkurrenskraftiga med andra organisationer. Kontinuerlig integration och kontinuerlig leverans (CI/CD) är metoder som används inom mjukvaruutvecklings världen, så att utvecklare kan automatisera delar av sitt arbete för att utveckla och leverera mjukvara snabbare och med bättre kvalité. Verktyg som används för CI/CD kommer med olika fördelar och prestanda som gör det svårt för utvecklare att välja ett verktyg. Det finns många verktyg att välja mellan och det finns en brist på prestandajämförelser av dem. Detta examensarbete syftar till att ge utvecklare en prestandajämförelse mellan de två välkända CI/CD-verktygen GitHub Actions och Jenkins, för att underlätta utvecklarens val av ett CI/CD-verktyg. En kvalitativ, induktiv och komparativ forskningsmetod användes för att genomföra denna studie. En litteraturstudie och praktiska tester genomfördes för att studera prestandaskillnader mellan de två välkända CI/CD-verktygen GitHub Actions och Jenkins. Litteraturstudien genomfördes först och gav författarna nödvändiga kunskap för att utföra dem praktiska testerna, dem praktiska testerna gav de faktiska resultaten. Praktiska testerna utfördes på två olika mjukvaruprojekt och två olika tester per projekt, en per server genomfördes. Resultaten från båda projekten visade på uppenbara skillnader i prestanda mellan GitHub Actions och Jenkins. Då Jenkins kördes snabbare än GitHub Actions när körningen kördes på en Windows server och GitHub Actions kördes snabbare än Jenkins när de kördes på en Ubuntu server. Dessa resultat tyder på att de två välkända CI/CD-verktygen fungerar olika beroende på vilken server utvecklarna skulle använda dessa verktyg på. Det går inte att dra slutsatsen att ett verktyg är bättre över det andra, i stället har ett verktyg bättre prestanda beroende på vilket operativ system verktyget körs på. Om utvecklarna skulle använda verktygen på en Ubuntu server skulle GitHub Actions vara det föredragna verktyget och om utvecklarna skulle använda verktyget på en Window server skulle Jenkins vara det föredragna verktyget.

Over the last few years, DevOps has gained much attention in the IT development field. It is a new way of thinking of how developers and operators work, which aim to integrate the development, testing, and operation work efficiently. DevOps breaks down communication silos, improve collaboration and productivity by automating infrastructure deployment, workflows, continuously improving the integration and delivery process, and measuring the application performance indicators. Automation is crucial in DevOps, and a key aspect of automation is “Infrastructure as code (IaC)”. IaC allows companies to manage and maintain their infrastructure resources such as virtual machines, load balancers, firewalls, and network devices programmatically in codes instead of manual processes and procedures. As a result, companies will be able to provision and deploy these infrastructure resources consistently, increase the rate of software delivery and improve the time to market, which in turns lead to a substantial competitive advantage. Previous research call for an examination of the gained opportunities and the challenges that can be faced in implementing IaC. Understanding these challenges and opportunities and their implications allow the companies to know why IaC can be interesting for them? And what and how changes should be done to adopt IaC. This paper presents a qualitative study that aims to illustrate the opportunities and challenges in implementing Infrastructure as a code. This paper will also present how infrastructure used to be managed in physical datacenter and cloud systems, and how agile, DevOps and IaC affect the infrastructure management. Our findings show considerable benefits in adopting IaC, and some challenges might be encountered when implementing IaC. Furthermore, the study acknowledges the role of agile, cloud systems, and DevOps in facilitating the implementation of Infrastructure as a code. Keywords: DevOps, Infrastructure as a code, Automation, Infrastructure resources, agile, cloud systems / <p></p><p></p><p></p>

Submitted by Franciele Moreira (francielemoreyra@gmail.com) on 2017-09-11T13:42:06Z No. of bitstreams: 2 Dissertação - Jailton Alkimin Louzada - 2017.pdf: 5226619 bytes, checksum: bb291ad68acd8cf80fcb2c6c2392c596 (MD5) license_rdf: 0 bytes, checksum: d41d8cd98f00b204e9800998ecf8427e (MD5) / Approved for entry into archive by Luciana Ferreira (lucgeral@gmail.com) on 2017-09-15T15:43:54Z (GMT) No. of bitstreams: 2 Dissertação - Jailton Alkimin Louzada - 2017.pdf: 5226619 bytes, checksum: bb291ad68acd8cf80fcb2c6c2392c596 (MD5) license_rdf: 0 bytes, checksum: d41d8cd98f00b204e9800998ecf8427e (MD5) / Made available in DSpace on 2017-09-15T15:43:54Z (GMT). No. of bitstreams: 2 Dissertação - Jailton Alkimin Louzada - 2017.pdf: 5226619 bytes, checksum: bb291ad68acd8cf80fcb2c6c2392c596 (MD5) license_rdf: 0 bytes, checksum: d41d8cd98f00b204e9800998ecf8427e (MD5) Previous issue date: 2017-08-11 / The Information Technology (I.T) market is growing. In the age of information, world economies have been investing more and more in the services market. Within this competitive scenario, software testing is an important component for raising the quality of software developed in Brazil and in the global competitiveness cenario. However, Small and medium-sized enterprises (SMEs) have limited resources for investments in software testing maturity processes, tools and models in their business. Faced with this, this work has as main proposal to produce an apparatus to improve the process of software testing for SMEs. Objective: As the main objectives, this study proposed a more update version of the FreeTest 1.0 process, as well as practical instructions on how to implement the activities suggested in the process, all this formatted in a new process and a wizard respectively. Methodology: In order to fulfill the objectives of this work, the FreeTest 2.0 process was created as an improvement of the FreeTest Method process, focused mainly on Agile techniques, DevOps and aligned with the SMEs ecosystem. And the FreeTest Wizard, which consists of a deployment guide that supports the implementation of the process in a didactic, dynamic and flexible way. Another contribution of this work was the creation of support tools to disseminate this knowledge and content management, in this case the creation of a web platform, distributed free of charge and in the format "as a Service". Finally, the results and conclusions can be seen in the final chapter of this work. / O mercado de Tecnologia da Informação (T.I.) é crescente. Na era da informação, as economias mundiais investem cada vez mais no mercado de Serviços. Dentro deste cenário competitivo, o teste de software é um importante componente para elevação da qualidade do software desenvolvido no Brasil e sua competitividade mundial. Contudo, as Micro e Pequenas Empresas (MPEs) possuem recursos limitados para investimentos em processos, ferramentas e modelos de maturidade de teste de software em seus negócios. Diante disto, este trabalho tem como proposta principal produzir um aparato para melhoria do processo de teste de software para MPEs. Objetivo: Como objetivos principais, este estudo propôs uma versão mais atualizada do processo FreeTest 1.0, bem como instruções práticas de como implantar as atividades sugeridas no processo, tudo isso formatado em um novo processo e um guia de implantação, respectivamente. Metodologia: Com o propósito de cumprir os objetivos almejados neste trabalho foram criados: 1) o processo FreeTest 2.0 como uma melhoria do processo do FreeTest 1.0, focado principalmente em técnicas Ágeis, DevOps e alinhado ao ecossistema das MPEs; e 2) o FreeTest Wizard, que consiste em um guia de implantação que apoia a implantação do processo de forma didática, dinâmica e flexível. Outra contribuição deste trabalho foi a criação de ferramentas de apoio para disseminação deste conhecimento e gestão dos conteúdos, neste caso, a criação de uma plataforma web distribuída de forma gratuita e no formato "as a Service". Por fim, os resultados e conclusões serão vistos no capítulo final deste trabalho.

In an era of technological growth, cloud computing is one of the hottest topics on the market. This, along with the overall increased use of digital systems, requires solid integration options to be developed. Redpill Linpro recognizes this and has developed a cloud-based Integration Platform as a Service (IPaaS) solution called Connectivity Engine. New techniques like this can however seem very abstract to a customer, something which a demo application could help substantiate. To aid in this issue we have developed a web-based Enterprise Resource Planning (ERP) system as well as an Integration Application to connect the ERP system with Salesforce.com in a bidirectional integration. With the use of Connectivity Engine this can be hosted in the cloud and be easily accessible. The project has been a success for Redpill Linpro as well as the authors. A solid way to demonstrate the abilities of Connectivity Engine has been developed along with descriptive documentation for any sales representative assigned to pitch the platform.

Applikationsövervakning är en term för att i realtid övervaka applikationer och kunna upptäcka fel innan slutanvändaren märker av ett problem. Med övervakning av applikationer menas inte bara den enskilda programvaran utan allt som rör applikationen i fråga. Trafikverkets önskemål är att leverera en hög kvalité i sina applikationer. I nuläget har utvecklare ingen eller dålig insyn i hur en applikation levererar i en skarp miljö efter att de lämnat över ansvaret till drift. För att kunna hålla en bra kvalité i sina applikationer så vill de undersöka hur applikationsövervakning kan hjälpa till att se behov av ändringar i applikationer innan större problem uppstår. I en fallstudie bestående av intervjuer och dokumentstudier kommer genom användning av situationsbaserad FA/SIMM nuvarande arbetssätt fångas. Samt fånga mål och problem som uttrycks i verksamheten kring utveckling &amp; förvaltning och drift av applikationer. Dessa kommer sedan analyseras för att undersöka på vilket sätt applikationsövervakning skulle hjälpa utvecklare &amp; förvaltare, men även driftspersonal i deras arbete. Resultatet av detta visar att de problem och mål som tas upp dels är organisatoriska i sin natur och arbetssättet DevOps framhålls som en möjlig lösning. Även att applikationsövervakning de facto skulle kunna bidra till en ökad kvalité i applikationerna genom att tillföra en möjlighet att arbeta mer proaktivt. / Application monitoring is a term for real-time monitoring of applications to be able to discover faults before they reach the end-user. Application monitoring does not only mean the individual software but also everything surrounding it, which can have an impact on the application. Trafikverket wishes to deliver high quality in their applications. At present the developers have no or little insight in how an application delivers in a live environment after they handed over the responsibility to the operations. In order to maintain a good quality of their applications they want to explore how application monitoring may help to see changes in the needs of applications before major problems occur. In a case study consisting of interviews and document studies and through situation based FA/SIMM present ways of working will be produced. It will also identify wishes/concerns expressed by the developers and operations departments in the managing of existent applications. These will then be analyzed to examine in which way application monitoring would help developers, but also operations, in their work. The result shows that the problems which are brought forward are in a sense organizational of nature and that DevOps is a possible way for solution. But also that application monitoring could contribute to the delivery of high quality in applications in a proactive manor.

When the traditional approach to system development transitioned over to agile methods the demand for ways to continuously deliver valuable software increased. With the increasing interest in these methods the umbrella term DevOps were introduced in 2008. DevOps is the practice to shorten the time, as well as streamlining the process, between changes in the source code and when it reaches the customer. This study aimed at investigating the process of adopting DevOps practices and identify success factors and challenges in this transition. We conducted a quality approached case study on a DevOps team in a multinational IT-consulting firm. Four explorative interviews were conducted based on categories identified in relevant literature as well as basis provided by the case company. We discovered that an implementation of continuous practices is far more complex than we initially thought. It is related to more fields outside the technical aspect that must be considered during a transition.  Our findings include four critical success factors for a successful DevOps implementation; conscious staff, conscious organization, functional infrastructure and adapted business model. Embedded in these critical success factors we were able to identify challenging fields that should be considered when adopting DevOps. These critical success factors and challenges was the basis for our model presented in the study.

One approach to continuously achieve a certain data quality level is to use an integration pipeline that continuously checks and monitors the quality of a data set according to defined metrics. This approach is inspired by Continuous Integration pipelines, that have been introduced in the area of software development and DevOps to perform continuous source code checks. By investigating in possible tools to use and discussing the specific requirements for RDF data sets, an integration pipeline is derived that joins current approaches of the areas of software development and semantic web as well as reuses existing tools. As these tools have not been built explicitly for CI usage, we evaluate their usability and propose possible workarounds and improvements. Furthermore, a real world usage scenario is discussed, outlining the benefit of the usage of such a pipeline.

For several years a trend in agile software development methodologies that connect the development with operations is transforming business activities in the industry. This methodology, that breaks down the formerly separated silos of development and operations is commonly referred to as DevOps. From a security point of view, however, the DevOps methodology lacks a fundamental integration of security in any of its phases. As a result of that, the DevSecOps practice, that intertwines the disciplines of security, development and operations is more and more gaining popularity. The biggest challenge in this shift of practice is the flawless introduction of security methods into existing DevOps processes without disturbing the fast pace and responsiveness of those. Whereas the security integration and processes on how to make DevOps secure are discussed in various preceding studies, this research focuses on an investigation of criteria that can be used to measure application security in DevSecOps integration. Given the lack of a fundamental base of academic literature on the topic, a Multivocal Literature Review (MLR) was conducted. For the study, not only academic research but also gray literature such as blogs and articles from industry practitioners were investigated to extract meaningful review criteria. As applicable, high-level criteria, agreed-upon best-practices and descriptions of security controls were thereby examined and compiled out of the studied literature. The criteria resulting from the conducted MLR process were further analyzed with each criterion's coverage in existing security standards in mind. Additionally, an investigation of a criterion's connection to the fundamental principles of the DevOps methodology was performed. The resulting list of criteria as well as additional, partially classified sub-criteria are presented as the primary contribution of the thesis. Further, a discussion of the results and evaluation of the criteria for measurability and applicability with the help of an expert group from the cooperating company Veriscan Security AB was performed. Lastly, the conducted study highlights the current state of research on the topic, discusses the lack of knowledge for particular areas as well as serves as a foundation and suggestion for several fields of future research. The criteria could, for instance, enable future design science research on DevSecOps security measurement.