@conference {2025:profes,
	title = {Pipelines Under Pressure: An Empirical Study of Security Misconfigurations of GitHub Workflows},
	booktitle = {26th International Conference on Product-Focused Software Process Improvement (PROFES)},
	year = {2025},
	month = {December},
	pages = {220{\textendash}236},
	publisher = {Springer},
	organization = {Springer},
	address = {Salerno, Italy},
	abstract = {Continuous Integration and Continuous Deployment (CI/ CD) pipelines have grown in popularity in recent years and are essential in streamlining the process of development and deployment of high quality software. However, developers often overlook security concerns in CI/CD pipelines, opening the door to many vulnerabilities. This paper presents an empirical investigation of nine security misconfigurations sourced from a comprehensive review of security guidelines, developer blogs, GitHub documentation, and prior research. To study the presence, co-occurrence and yearly trends of these security misconfigurations within current CI/CD practices, we analyzed a large dataset containing the most recent version of over 200{\textquoteright}000 GitHub workflow specification files, taken from open source repositories. To aid us in this study, we developed Soteria, a static analysis tool equipped with custom detectors that can systematically identify security misconfigurations. Given that less than 1\% of the analyzed workflows do not include any misconfiguration, our detection tool makes a contribution to raise awareness about widespread security misconfigurations. Our findings challenge conventional practices and motivate the need for an urgent shift in how security principles are systematically applied in the development and operation of CI/CD pipelines with more robust and finer-grained security controls.},
	keywords = {CI/CD Build Pipeline, DevOps, GitHub Actions, Security Misconfigurations, Workflows},
	doi = {10.1007/978-3-032-12089-2_14},
	author = {Edoardo Riggio and Cesare Pautasso}
}
@book {2023:map,
	title = {Patterns for API Design: Simplifying Integration with Loosely Coupled Message Exchanges},
	series = {Addison-Wesley Signature Series (Vernon)},
	year = {2023},
	pages = {544},
	publisher = {Pearson Education},
	organization = {Pearson Education},
	abstract = {Proven Patterns for Designing Evolvable High-Quality APIs--For Any Domain, Technology, or Platform

APIs enable breakthrough innovation and digital transformation in organizations and ecosystems of all kinds. To create user-friendly, reliable and well-performing APIs, architects, designers, and developers need expert design guidance. This practical guide cuts through the complexity of API conversations and their message contents, introducing comprehensive guidelines and heuristics for designing APIs sustainably and specifying them clearly, for whatever technologies or platforms you use.

In Patterns for API Design: Simplifying Integration with Loosely Coupled Message Exchanges, five expert architects and developers cover the entire API lifecycle, from launching projects and establishing goals through defining requirements, elaborating designs, planning evolution, and creating useful documentation. They crystallize the collective knowledge of many practitioners into 44 API design patterns, consistently explained with context, pros and cons, conceptual solutions, and concrete examples. To make their pattern language accessible, they present a domain model, a running case study, decision narratives with pattern selection options and criteria, and walkthroughs of real-world projects applying the patterns in two different industries.},
	keywords = {API Design Patterns},
	isbn = {9780137670017},
	url = {https://api-patterns.org},
	author = {Olaf Zimmermann and Mirko Stocker and Daniel L{\"u}bke and Uwe Zdun and Cesare Pautasso}
}
@conference {2021:plop,
	title = {Patterns on Designing API Endpoint Operations},
	booktitle = {28th Conference on Pattern Languages of Programs (PLoP{\textquoteright}21)},
	year = {2021},
	month = {October},
	publisher = {ACM},
	organization = {ACM},
	address = {Virtual},
	abstract = {Domain-driven design (DDD) is often applied when implementing microservices or communicating through APIs in distributed
systems. APIs expose a published language that provides a view on entire domain models or subsets of such models. Hence,
tactical DDD patterns such as Aggregate, Service, and Entity may not only structure API implementations, but also guide API
specification work. In our previous work, we described endpoint-level patterns for this context. In this paper, we present three
complementary patterns, namely Aggregated Domain Operation on API Endpoint, Event-Based API Endpoint Operation, and
CRUD-Based API Operation. These patterns aim to derive API operations from the operations of Domain Services and Entities
as well as Domain Events. We also discuss variants of these patterns, such as their combination with the patterns Command
Query Responsibility Segregation (CQRS) and Publish/Subscribe. Our pattern mining work is based on a data set from an
empirical study of 32 grey literature sources investigating practitioner views on deriving API designs from DDD models.},
	keywords = {API, Domain-Driven Design},
	author = {Apitchaka Singjai and Uwe Zdun and Olaf Zimmermann and Mirko Stocker and Cesare Pautasso}
}
@conference {2018:blockchain:europlop,
	title = {A Pattern Collection for Blockchain-based Applications},
	booktitle = {23rd European Conference on Pattern Languages of Programs (EuroPLoP)},
	year = {2018},
	month = {July},
	publisher = {ACM},
	organization = {ACM},
	address = {Kloster Irrsee, Germany},
	abstract = {Blockchain is an emerging technology that enables new forms of decentralized software architectures, where distributed components can reach agreements on shared system states without trusting a central integration point. Blockchain provides a shared infrastructure to execute programs, called smart contracts, and to store data. Since blockchains are at an early stage, there is a lack of a systematic and holistic view on designing software systems that use blockchain. We view blockchain as part of a bigger system, which requires patterns of using blockchain in the design of the bigger systems. In this paper, we collect a list of patterns for blockchain-based applications. The pattern collection is categorized into four types, including interaction with external world patterns, data management patterns, security patterns and contract structural patterns. Some patterns are designed specifically based on real-world blockchain-based applications considering the nature of blockchain. Others are variants of existing design patterns applied in the context of blockchain-based applications and smart contracts.},
	keywords = {blockchain, patterns},
	doi = {10.1145/3282308.3282312},
	url = {https://dl.acm.org/citation.cfm?id=3282312},
	author = {Xiwei Xu and Cesare Pautasso and Liming Zhu and Qinghua Lu and Ingo Weber}
}
@conference {2017:europlop,
	title = {A Pattern Language for Workflow Engine Conformance and Performance Benchmarking},
	booktitle = {22nd European Conference on Pattern Languages of Programs (EuroPLoP)},
	year = {2017},
	month = {July},
	publisher = {ACM},
	organization = {ACM},
	address = {Kloster Irsee, Germany},
	abstract = {Workflow engines are frequently used in the domains of business process management, service orchestration, and cloud computing, where they serve as middleware platforms for integrated business applications. Engines have a significant impact on the quality of service provided by hosted applications. Therefore, it is desirable to compare them and to select the most appropriate engine for a given task. To enable such a comparison, approaches for benchmarking workflow engines have emerged. Although these approaches deal with different quality attributes, i.e., performance or standard conformance, they face many reoccurring design and implementation problems, which have been solved in similar ways. In this paper, we present a pattern language that captures such common solutions to reoccurring problems (e.g., from test identification, benchmarking procedure validation, automatic engine interaction, and workflow execution observation) in the area of workflow engine conformance and performance benchmarking. Our aim is to help future benchmark authors with the pattern language presented in this paper to benefit from our experience with the design and implementation of workflow engine benchmarks and benchmarking tools},
	keywords = {BenchFlow, pattern language},
	doi = {10.1145/3147704.3147705},
	author = {Simon Harrer and J{\"o}rg Lenhard and Oliver Kopp and Vincenzo Ferme and Cesare Pautasso}
}
@proceedings {2017:benchflow:bpmds,
	title = {Performance Comparison Between BPMN 2.0 Workflow Management Systems Versions},
	year = {2017},
	month = {June},
	publisher = {Springer},
	address = {Essen, Germany},
	abstract = {Software has become a rapidly evolving artifact and Workflow Management Systems (WfMSs) are not an exception. WfMSs{\textquoteright} changes may impact key performance indicators or resource consumption levels may change among different versions. Thus, users considering a WfMS upgrade need to evaluate the extent of such changes for frequently issued workload.  Deriving such information requires running performance experiments with appropriate workloads. 
In this paper, we propose a novel method for deriving a structurally representative workload from a given business process collection, which we later use to evaluate the performance and resource consumption over four versions of two open-source WfMSs, for different numbers of simulated users. In our case study scenario the results reveal relevant variations in the WfMSs{\textquoteright} performance and resource consumption, indicating a decrease in performance for newer versions.},
	keywords = {BenchFlow, BPMN, Performance Regression, Performance Testing, workflow engine, Workflow Management Systems},
	author = {Vincenzo Ferme and Marigianna Skouradaki and Ana Ivanchikj and Cesare Pautasso and Frank Leymann}
}
@conference {benchflow:2017:bpm,
	title = {On the Performance Overhead of BPMN Modeling Practices},
	booktitle = {15th International Conference on Business Process Management (BPM2017)},
	year = {2017},
	month = {September},
	pages = {216--232},
	publisher = {Springer},
	organization = {Springer},
	address = {Barcelona, Spain},
	abstract = {Business process models can serve different purposes, from discussion and analysis among stakeholders, to simulation and execution. 
While work has been done on deriving modeling guidelines to improve understandability, it remains to be determined how different modeling practices impact the execution of the models. 
In this paper we observe how semantically equivalent, but syntactically different, models behave in order to assess the performance impact of different modeling practices. 
To do so, we propose a methodology for systematically deriving semantically equivalent models by applying a set of model transformation rules and for precisely measuring their execution performance. 
We apply the methodology on three scenarios to systematically explore the performance variability of 16 different versions of parallel, exclusive, and inclusive control flows. 
Our experiments with two open-source business process management systems measure the execution duration of each model{\textquoteright}s instances. 
The results reveal statistically different execution performance when applying different modeling practices without total ordering of performance ranks.
},
	keywords = {BenchFlow, BPMN, performance},
	doi = {10.1007/978-3-319-65000-5_13},
	author = {Ana Ivanchikj and Vincenzo Ferme and Cesare Pautasso}
}
@proceedings {zeus2017,
	title = {Proceedings of the 9th Central European Workshop on Services and their Composition (ZEUS 2017)},
	year = {2017},
	month = {February},
	publisher = {CEUR-WS.org},
	address = {Lugano, Switzerland},
	keywords = {Web service composition},
	url = {http://ceur-ws.org/Vol-1826/},
	author = {Oliver Kopp and J{\"o}rg Lenhard and Cesare Pautasso}
}
@conference {restalk:2016:europlop,
	title = {A Pattern Language for RESTful Conversations},
	booktitle = {Proceedings of the 21st European Conference on Pattern Languages of Programs (EuroPLoP)},
	year = {2016},
	month = {July},
	pages = {4:1{\textendash}4:22},
	publisher = {ACM},
	organization = {ACM},
	address = {Kloster Irsee, Germany},
	abstract = {As a good user interface design is important for the success of an app, so is a good API for the success of a Web service. Within the RESTful Web services community there is a need for a systematic approach in knowledge sharing, for which patterns are particularly suitable. Using a RESTful service to achieve a certain goal often requires multiple client-server interactions, i.e., to have a conversation. While patterns of such RESTful conversations can be uncovered from existing APIs{\textquoteright} usage scenarios, or the service engineering literature, they have never been gathered in a pattern language, nor properly visualized with a Domain Specific Modeling Language (DSML). These patterns provide valuable input for API designers, as well as API consumers, by establishing a common vocabulary to describe recurring conversations. To do so, this paper uses RESTalk, a DSML, to model the basic RESTful conversation patterns structured around the life cycle of a resource (create, discover, read, edit, delete, protect) by showing the corresponding sequences of HTTP request-response interactions. We show how the resulting pattern language can be applied to individual resources, or also collections of resources.},
	keywords = {conversation composition, conversation patterns, pattern language, RESTalk, RESTful conversation, RESTful web services},
	isbn = {978-1-4503-4074-8},
	doi = {10.1145/3011784.3011788},
	url = {http://doi.acm.org/10.1145/3011784.3011788},
	author = {Cesare Pautasso and Ana Ivanchikj and Silvia Schreier}
}
@proceedings {icsoc2013,
	title = {Proceedings of the 11th International Conference on Service-Oriented Computing (ICSOC 2013)},
	volume = {8274},
	year = {2013},
	month = {December},
	publisher = {Springer},
	address = {Berlin, Germany},
	keywords = {proceedings, service oriented computing},
	isbn = {978-3-642-45004-4},
	issn = {0302-9743},
	doi = {10.1007/978-3-642-45005-1},
	url = {http://link.springer.com/10.1007/978-3-642-45005-1},
	editor = {Basu, Samik and Cesare Pautasso and Zhang, Liang and Fu, Xiang}
}
@article {DBLP:journals/internet/VitvarVP12,
	title = {Programmatic Interfaces for Web Applications},
	journal = {IEEE Internet Computing},
	volume = {16},
	number = {4},
	year = {2012},
	pages = {11-14},
	keywords = {programmable web, REST, Web APIs, Web services},
	doi = {http://doi.ieeecomputersociety.org/10.1109/MIC.2012.86},
	author = {Tomas Vitvar and Steve Vinoski and Cesare Pautasso}
}
@conference {rest:bpm:icsoc2011,
	title = {Push-Enabling RESTful Business Processes},
	booktitle = {9th International Conference on Service-Oriented Computing (ICSOC 2011)},
	volume = {7084},
	year = {2011},
	month = {December},
	pages = {32-46},
	publisher = {Springer},
	organization = {Springer},
	address = {Paphos, Cyprus},
	abstract = {Representational State Transfer (REST) as an architectural style for service design has seen substantial uptake in the past years. However, some areas such as Business Process Modeling (BPM) and push services so far have not been addressed in the context of REST principles. In this work, we look at how both BPM and push can be combined so that business processes can be modeled and observed in a RESTful way. Based on this approach, clients can subscribe to be notified when certain states in a business process are reached. Our goal is to design an architecture that brings REST{\textquoteright}s claims of loose coupling and good scalability to the area of BPM, and still allow process-driven composition and interaction between resources to be modeled.},
	keywords = {business process management, REST, RESTful business process management},
	doi = {10.1007/978-3-642-25535-9_3},
	author = {Cesare Pautasso and Erik Wilde}
}
@inproceedings {jopera:2006:works,
	title = {Parallel Computing Patterns for Grid Workflows},
	year = {2006},
	month = {June},
	address = {Paris, France},
	abstract = {Whereas a consensus has been reached on defining the set of workflow patterns for business process modeling languages, no such patterns exists for workflows applied to scientific computing on the Grid. By looking at different kinds of parallelism, in this paper we identify a set of workflow patterns related to parallel and pipelined execution. The paper presents how these patterns can be represented in different Grid workflow languages and discusses their implications for the design of the underlying workflow management and execution infrastructure. A preliminary classification of these patterns is introduced by surveying how they are supported by several existing advanced scientific and Grid workflow languages.},
	keywords = {grid computing, scientific workflow management, survey, workflow patterns},
	author = {Cesare Pautasso and Gustavo Alonso}
}
@conference {jopera:2005:escience,
	title = {Publishing Persistent Grid Computations as WS Resources},
	booktitle = {1st IEEE International Conference on e-Science and Grid Computing (e-Science 2005)},
	year = {2005},
	month = {December},
	publisher = {IEEE},
	organization = {IEEE},
	address = {Melbourne, Australia},
	abstract = {Grid services can be composed into processes, providing a high level definition of the computations involved in terms of their data exchanges and control flow dependencies. We show how processes themselves can be efficiently published as Grid services by mapping the persistent state of the process executions to standard compliant interfaces as defined by the Web Services Resource Framework (WS-RF). Mapping processes to resources is a fundamental step to enable recursive Grid service composition, where composite Grid services are themselves published as services. This gives processes a standardized and wellunderstood interface that enables their management, monitoring, steering and adaptation. Additionally it eases their reusability and simplifies integration into existing Grid applications and portals. In order to determine the mapping{\textquoteright}s overhead, we include the results of a comprehensive performance evaluation.},
	keywords = {grid computing, JOpera, scientific workflow management},
	doi = {10.1109/E-SCIENCE.2005.67},
	author = {Thomas Heinis and Cesare Pautasso and Oliver Deak and Gustavo Alonso}
}
@conference {93,
	title = {Programming for dependability in a service-based grid},
	booktitle = {3rd IEEE/ACM International Symposium on Cluster Computing and the Grid, 2003 (CCGrid 2003)},
	year = {2003},
	month = {May},
	pages = {164 - 171},
	publisher = {IEEE},
	organization = {IEEE},
	address = {Tokyo, Japan},
	abstract = {Service-based Grid infrastructures emphasize service composition rather than sharing of low level resources. The idea is to build Grid applications out of computational services provided by the different sites of the Grid. Recent developments in the area of Web services have strengthened this idea by standardizing procedures like service description, publication and invocation. What is still missing is the infrastructure necessary to support the complete life cycle of applications running on service based Grids, i.e., suitable programming paradigms, execution infrastructure, and the ability to monitor and control such computations. Moreover, once computations are made of composable services, dependability becomes a key issue that needs to be addressed by the infrastructure as it cannot be addressed separately by each individual service. To address these concerns, we have developed the BioOpera Grid computing platform. BioOpera is a process support system for dependable cluster computing that has been extended with additional functionality to provide adequate support for service-based Grids. In this paper we describe how BioOpera can be used to develop, execute, and administer highly dependable computations over service-based Grids.},
	keywords = {BioOpera, distributed business process execution engines, grid computing, Web services},
	isbn = {0-7695-1919-9},
	doi = {10.1109/CCGRID.2003.1199365},
	url = {http://ieeexplore.ieee.org/lpdocs/epic03/wrapper.htm?arnumber=1199365},
	author = {Win Bausch and Cesare Pautasso and Gustavo Alonso}
}
