Sometimes, the best way to harden a service is to outsource it. I've dabbled with running my own CI service for PRs. Running *arbitrary* third party patches is scary. Malware! Crypto miners! It's really nice not having to worry about that.