Chainguard is proof that modern CI/CD is still a luxury product for most of the industry. They have a fantastic amount of automation behind image production, including some tools they rolled themselves (like apko).

Disclosure: I am friends with / have worked with some Chainguard folks.

Declarative image builds, nightly rebuilds of the whole ecosystem, and they bake the SBOM into the images. It is a really good offering. It's a shame we had to use the competing offering from RedHat for contractual reasons.