This is the same in case of an official build: if some attacker was able to modify what happens in a build that makes it to production, I need logs to build an

This is the same in case of an official build: if some attacker was able to modify what happens in a build that makes it to production, I need logs to build an understanding and explain to auditor/governments exactly what happened, what the effect was, and how I’ll mitigate it. Since all logs should be immediately persisted off box, they are protected from tampering. Of course there’s no reason the default view of logs in the CI/CD system needs to be so verbose.