SECURING CI/CD PIPELINES WITH SAFETY-BOUNDED ALERT TRIAGE: A CLUSTER-THEN-CLASSIFY DEVSECOPS FRAMEWORK

Abstract

Automated security-alert triage in Continuous Integration and Continuous Delivery (CI/CD) pipelines is critical for mitigating alert fatigue while preventing high-impact threat leakage. Standard machine learning approaches often fail to capture latent pipeline behavioral patterns and treat all classification errors equally, risking the silent dismissal of critical vulnerabilities. This paper presents an end-to-end, multi-stage triage architecture designed to categorize heterogeneous CI/CD telemetry into three operational actions: auto-dismissal, automated pipeline retry, and Security Operations Center (SOC) escalation. The methodology integrates three key components: (1) multi-modal feature fusion utilizing term frequency-inverse document frequency (TF-IDF) log modeling reduced via singular value decomposition (SVD), combined with target-encoded scanner metadata; (2) Gaussian Mixture Model (GMM) soft-clustering to embed latent operational behavior directly into the feature space; and (3) a cost-sensitive XGBoost classifier governed by a novel cost-weighted focal loss function that heavily penalizes severe misclassifications. To guarantee operational safety, split conformal prediction is applied as a final risk-control layer, deferring ambiguous or multi-label predictions to human analysts. Evaluated on  execution instances from the Kaggle AI-Driven CI/CD Pipeline Logs Dataset using an 80/10/10 split protocol, the framework achieved a macro -score of  and reduced the critical threat false negative rate (FNR) to . Conformal calibration at  bounded empirical risk to , while automated handling resolved  of incoming telemetry without manual intervention. These results demonstrate that combining unsupervised structural embeddings with calibrated conformal safety layers offers a highly reliable, low-overhead solution for modern SecOps environments.