Do they offer end to end encryption and signing. That would make your ci say f-off it the image has been played around with, and also protect any secrets, although there is no need to have source code or passwords in the image anyway.