That seems fine, in the same way that e.g. an XML library fetching DTDs from a known public URL is fine. However, it'd probably be better if you could have the

That seems fine, in the same way that e.g. an XML library fetching DTDs from a known public URL is fine. However, it'd probably be better if you could have the CI framework collect and inject that information into the build using some hard-coded deterministic logic, rather than giving the build itself (developer-driven Arbitrary Code Execution) access to that capability. Same idea as e.g. injecting Kubernetes Secrets into Pods as env-vars at the controller level, rather than giving the Pod itself the permission to query Secrets out of the controller through its API.