If the CI runs the build of arbitrary projects, it already has a huge vector surface for attacks: xcode projects can contain shell scripts, ... So xcode's App S

If the CI runs the build of arbitrary projects, it already has a huge vector surface for attacks: xcode projects can contain shell scripts, ... So xcode's App Store submission components having log4j won't likely allow for more exploits of CIs or local devices