CI runners may be hosted by a service or operated by a development team. They check out code, install dependencies, run tests and often build container images or publish release artifacts.
Because runners execute project scripts and handle credentials, they are part of the software supply chain. A compromised or outdated runner could leak tokens or alter the packages that reach production. A runner's own PHP installation can also differ from the PHP runtime inside the image it builds.
A successful CI job establishes only what its checks actually tested. It does not prove that a vulnerable package was replaced in production, or that all deployment replicas now use the patched image.
Use maintained runner images, restrict secrets and permissions, record build inputs and resulting artifacts, and include package and image checks in the pipeline. Verify the deployed workload separately after release.