An attacker steals a developer's Git credentials and pushes malicious code. How do you defend against this?

Core Summary

Assume one credential will eventually be stolen and design so that alone isn't enough to ship code. Layer identity, branch protection, review, signing, pipeline isolation and detection, and remember the attacker's real target is usually the CI workflow, not the application code itself.