Your CI system holds publishing credentials, signs releases, and runs code nobody on your team has reviewed. Its output is the software your customers run or use, which makes that pipeline production. Almost nobody treats it that way.

We'll map the trust boundary of your pipeline: where third-party code runs, which secrets are in reach, and who controls the definition. Then we'll repeat it on a developer laptop, where an AI agent drives builds and tooling with your credentials and less oversight than CI. Codecov and tj-actions both fell to trusted tooling nobody reviewed.

You'll leave able to draw both boundaries yourself. The hardening that pays off first: pinned versions, scoped tokens, ephemeral runners, and build records you keep long enough to answer questions later.