Ok that's at least something. But my CI can download and run code from everywhere, so that doesn't mean that I can know what is being uploaded just looking at

Ok that's at least something. But my CI can download and run code from everywhere, so that doesn't mean that I can know what is being uploaded just looking at the git repository alone.