Contents
Summary
Claim: Only approximately 40% of open source projects use continuous integration at all.
Bottom Line: The 40% CI adoption figure is likely correct as a historical data point from the seminal 2016 Hilton et al. study, but is very likely outdated as a description of current adoption. GitHub Actions alone matched the entire 40% rate by January 2022. The figure is also sensitive to population definition — active projects show much higher CI adoption than the full repository population including abandoned and hobby projects. The researcher should not present 40% as a current figure.
Results
| Artifact |
Description |
| Input |
Original text, clarification, scope, vocabulary |
| Assessment |
Evidence synthesis, probability assessment, gaps |
| Self-Audit |
Process audit across 4 ROBIS domains |
| Reading List |
Prioritized source list |
Hypotheses
Searches
| ID |
Target |
Returned |
Selected |
| S01 |
H1 |
? |
? |
| S02 |
H2 |
? |
? |
| S03 |
H3 |
? |
? |
| S04 |
H1 |
? |
? |
| S05 |
H4 |
? |
? |
Sources
| ID |
Title |
Reliability |
Relevance |
| SRC001 |
https://mir.cs.illinois.edu/marinov/publications/HiltonETAL1 |
High |
High |
| SRC002 |
https://decan.lexpage.net/files/SANER-2022a.pdf |
High |
High |
| SRC003 |
https://www.sciencedirect.com/science/article/abs/pii/S01641 |
High |
High |
| SRC004 |
https://blog.jetbrains.com/teamcity/2026/03/best-ci-tools/ |
Medium |
Medium |
| SRC005 |
https://www.chainguard.dev/unchained/wolfis-upstream-securit |
Medium |
High |
| SRC006 |
https://www.scworld.com/news/open-source-vulnerabilities-per |
Medium |
High |
| SRC007 |
https://www.sonatype.com/state-of-the-software-supply-chain/ |
Medium |
High |
| SRC008 |
https://arxiv.org/html/2409.07669v2 |
High |
High |
| SRC009 |
https://www.pixee.ai/blog/sast-false-positives-reduction |
Medium |
High |
| SRC010 |
https://embeddedbits.org/how-is-the-linux-kernel-tested-embe |
Medium |
High |
| SRC011 |
https://www.kernel.org/doc/html/v6.5/dev-tools/testing-overv |
High |
High |
| SRC012 |
https://arxiv.org/html/2605.07900v1 |
High |
High |
| SRC013 |
https://www.nist.gov/news-events/news/2026/04/nist-updates-n |
High |
High |
| SRC014 |
https://www.moderne.ai/blog/security-dependency-updates-unma |
Medium |
High |
| SRC015 |
https://contribute.cncf.io/resources/services/hosted-tools/ |
High |
Medium |
| SRC016 |
https://www.linuxfoundation.org/research/maintainer-perspect |
High |
High |
Evidence Snapshot
| Dimension |
Rating |
| Evidence quality |
Robust |
| Source agreement |
High |
Revisit Triggers
- [study] A new large-scale empirical study (>50K repos) measures overall CI adoption across all CI tools combined, providing a post-2023 baseline figure.
- [data_update] GitHub publishes official aggregate statistics on GitHub Actions adoption as a percentage of active repositories.
- [study] Hilton et al. or similar research group publishes a follow-up study replicating the 2016 methodology on current repositories.
- [time] More than 12 months elapse from the date of this research (May 2026), as CI adoption rates are changing rapidly.
← Back to run overview