@article{ElHayaniPCBC2026:JSS,
    author = {{El Hayani}, Haitam and Philippe, Jolan and Challita, Stéphanie and Barais, Olivier and Combemale, Benoît},
    title = {Quality assurance in infrastructure as code: Issues, approaches, and open challenges},
    journal = {Journal of Systems and Software},
    pages = {113080},
    year = {2026},
    issn = {0164-1212},
    doi = {https://doi.org/10.1016/j.jss.2026.113080},
    url = {https://www.sciencedirect.com/science/article/pii/S0164121226003134},
    keywords = {Infrastructure as code, Quality assurance, DevOps, Cloud computing},
    abstract = {Infrastructure as Code (IaC) has emerged as a cornerstone of modern DevOps practices, enabling automated, repeatable, and scalable management of cloud and software infrastructure. However, the growing complexity of IaC scripts introduces quality issues, including defects, smells, and anti-patterns that can compromise system reliability, maintainability, and performance. To address these challenges, researchers have proposed various support mechanisms, such as linters or other static analysis tools, to assist DevOps engineers in producing higher-quality IaC scripts. However, existing knowledge remains fragmented across technologies, quality issues, and developed support approaches. This Systematic Literature Review synthesizes the state of the art by investigating the characteristics of quality issues, and the methods developed to mitigate them. Our findings reveal the community’s focus on security and operational issues, dominance of technology-specific studies, and a predominance of static analysis, with techniques that are mostly rule- and graph-based. We consolidate these insights in a feature model-based taxonomy and identify major gaps, including limited attention to performance, dynamic, and run-time behavior of infrastructure. These results imply a need for a holistic, technology-agnostic, and lifecycle-aware IaC quality assurance methods that reflect the complexity of modern cloud infrastructures.}
}