That’s already easy to do. In fact most CI/CD pipelines already work this way. The problem is you still have a compromised executable at the end of the pipeline

That’s already easy to do. In fact most CI/CD pipelines already work this way. The problem is you still have a compromised executable at the end of the pipeline. So you haven’t actually solved much.