Explainable Anomaly Detection for Secure CI/CD Pipelines: A Shapley Additive Explanations (SHAP) Approach

Continuous Integration and Continuous Deployment (CI/CD) pipelines have become critical attack surfaces in modern software supply chains. While machine learning (ML) techniques have demonstrated effectiveness in detecting anomalous developer commits, most existing approaches operate as black-box models, providing limited insight into why a particular commit is flagged as suspicious. This lack of interpretability hinders rapid incident response and reduces developer trust in automated security controls. This paper proposes an interpretable anomaly detection framework for secure CI/CD pipelines that integrates deep autoencoders with Shapley Additive exPlanations (SHAP). Unlike traditional unsupervised anomaly detection methods that output binary alerts, the proposed approach quantifies the marginal contribution of individual commit features—such as code churn, file entropy, and commit timing—to the overall anomaly score. This enables fine-grained, human-interpretable explanations that support security analysts and developers during investigation. We evaluate the proposed framework against widely used baseline models, including Isolation Forests and One-Class Support Vector Machines, on a real-world commit dataset. Experimental results demonstrate that the proposed method achieves superior detection performance (F1-score > 0.91) while providing transparent, feature-level explanations that reduce false positive investigation overhead. These findings highlight the potential of explainable anomaly detection to bridge the gap between high-performance ML security mechanisms and practical DevSecOps requirements.