This area is near and dear to my heart, and I would offer that the solution isn't to decouple CD over into its own special little thing but rather to make the C

This area is near and dear to my heart, and I would offer that the solution isn't to decouple CD over into its own special little thing but rather to make the CD "multi factor" in that it must be "sub":"repo:octo-org/octo-repo:environment:prod"[1] and feel free to sprinkle in any other [fun claims][] you'd like to harden that system 1: https://docs.github.com/en/actions/security-for-github-actions/security-hardening-your-deployments/configuring-openid-connect-in-amazon-web-services#:~:text=you%20can%20configure%20deployment%20rules%20on%20an%20environment%20to%20restrict%20which%20branches%20and%20tags%20can%20deploy%20to%20the%20environment%20or%20access%20environment%20secrets https://docs.github.com/en/actions/security-for-github-actio... fun claims: https://github.com/github/actions-oidc-debugger#readme https://github.com/github/actions-oidc-debugger#readme