qubes-like solutions are great at preventing malicious code from accessing your internal websites, but pretty useless from "code leak" perspective.

If you have downloaded a trojaned "super library" and put it to your build process, it will, by definition, be in the same security domain as your source code.

Unless you audit all file accesses and outgoing internet access, you won't be able to prevent code exfiltration.