What evidence do they have, or is it process of elimination, like source code built normal binaries locally, but malicious binaries when built in CI? Hope they

What evidence do they have, or is it process of elimination, like source code built normal binaries locally, but malicious binaries when built in CI? Hope they have some VM images of the CI boxes for forensic analysis. Really hoping I don't have to go back to Eclipse.