Like:
- always run all dev tools in a sandbox, including the compiler and language server
- proper secure (harden) developer systems
- don't install software outside of sandboxes which is known to be often less careful with security vulnerabilities, like steam (or games in general). Firewalls can help wrt. offline only games, but due to things like drm, invites, game updates etc. most modern game software is not offline only.
- split CI into components, make sure the part which builds (and potential deploys) artifacts doesn't run in the same sandbox as additional analysis tools. Potentially run different analysis tools in different sandboxes. Don't give CI sandboxes permissions to directly push to your repository etc. If a tool need to be able to push to git consider limiting it's access to a specific folder or if not possible sub-module (which tbh. are annoying).
- Limit internet access of CI sandboxes as far as possible.
Sadly some of this things are quite cumbersome or even impossible to setup with (at least non enterprise) github.