ReleaseGuard AI: An Explainable Multi-Signal Release Risk Analyzer and Deployment Gate for CI/CD Pipelines

Author

Mrs. R. Jenifer, Mahirunnisa S F, Monika S, Sanjanaa S

Abstract

 Continuous integration and continuous delivery (CI/CD) pipelines shorten release cycles, yet most pipelines still decide whether to ship using binary signals such as “did the tests pass?”. Such gates cannot express how risky a release is when the tests pass but the change touches authentication code, erodes test coverage or carries known vulnerabilities. This paper presents ReleaseGuard AI, an explainable release risk analyzer and deployment gate. The system fuses seven signals collected from Git, Pytest, Trivy and SonarQube (failed tests, coverage drop, CVE severity, code-quality debt, critical-module changes, change volume and deployment history) into a transparent weighted score between 0 and 100, applies hard overrides for failed tests and critical CVEs, and maps the score to ALLOW, WARN or BLOCK decisions that are enforced through CI exit codes. A second layer uses Google Gemini 2.5, with an offline heuristic fallback, to turn the flagged factors into remediation steps and a rollback plan without influencing the decision itself. Results are stored in SQLite, shown in a Streamlit dashboard and pushed to Slack or Teams. We evaluate the scoring engine on nine release scenarios with sensitivity and ablation analyses. The study shows graded, explainable decisions, and also exposes a calibration limit: without the overrides, a release can reach the 75-point block threshold only if every remaining signal saturates. We discuss this and other limitations and outline data-driven recalibration as future work.

Keywords

Release risk; DevOps; CI/CD quality gate; DevSecOps; explainable scoring; large language models; software quality

Full Text:

Download Paper PDF

References

Bhalla, J. S., & Jodhka, M. K. (2025). Leveraging large language models in the software development lifecycle: Opportunities and challenges. International Journal of Advanced Computer Science and Applications, 16(11), 43–51.

Boles, B., O’Donoghue, E., Manzi Muneza, R., Perkins, G., Izurieta, C., & Reinhold, A. M. (2024). Deciphering discrepancies: A comparative analysis of Docker image security. Proceedings of the 24th IEEE International Conference on Source Code Analysis and Manipulation (SCAM), 254–259. https://doi.org/10.1109/SCAM63643.2024.00034

Comanici, G., et al. (Gemini Team, Google). (2025). Gemini 2.5: Pushing the frontier with advanced reasoning, multimodality, long context, and next generation agentic capabilities. arXiv:2507.06261.

Forsgren, N., Humble, J., & Kim, G. (2018). Accelerate: The science of lean software and DevOps. IT Revolution Press.

Fu, M., Pasuksmit, J., & Tantithamthavorn, C. (2025). AI for DevSecOps: A landscape and future opportunities. ACM Transactions on Software Engineering and Methodology, 34, 1–61. https://doi.org/10.1145/3712190

Google Cloud DORA. (2024). Accelerate State of DevOps Report 2024. Google Cloud.

Javed, O., & Toor, S. (2021). Understanding the quality of container security vulnerability detection tools. arXiv:2101.03844.

Kamei, Y., Shihab, E., Adams, B., Hassan, A. E., Mockus, A., Sinha, A., & Ubayashi, N. (2013). A large-scale empirical study of just-in-time quality assurance. IEEE Transactions on Software Engineering, 39(6), 757–773.

Kurup, M., Suh, H., Vaidyanathan, S., Vyas, P., Madabhushi, S., & Silyutin, Y. (2026). Deployment risk assessment using diff-aware features: A case study at Prime Video. ASE 2026 Industry Showcase. arXiv:2607.06766.

Lenarduzzi, V., Lomio, F., Huttunen, H., & Taibi, D. (2020a). Are SonarQube rules inducing bugs? Proceedings of the 27th IEEE International Conference on Software Analysis, Evolution and Reengineering (SANER), London, Ontario, Canada.

Lenarduzzi, V., Saarimäki, N., & Taibi, D. (2020b). Some SonarQube issues have a significant but small effect on faults and changes: A large-scale empirical study. Journal of Systems and Software, 170, 110750. https://doi.org/10.1016/j.jss.2020.110750

Pytest Development Team. (n.d.). pytest documentation. https://docs.pytest.org/

Radenković, B., Prokhorov, S., Radenković, M., & Labus, A. (2025). Application of large language models in software development: Review of the current state and development perspectives. 2025 6th International Workshop on Engineering Technologies and Computer Science (EnT), 1–7. https://doi.org/10.1109/EnT68818.2025.11245717

SonarSource. (n.d.). SonarQube documentation. https://docs.sonarqube.org/

Streamlit Inc. (n.d.). Streamlit documentation. https://docs.streamlit.io/

Zhao, Y., Damevski, K., & Chen, H. (2023). A systematic survey of just-in-time software defect prediction. ACM Computing Surveys, 55(10), Article 201.

Share your valuable work from Social Media Buttons