Supply Chain Security
Everything between a dependency and a running artifact is attack surface: pinning, scanning with context, signing, provenance and SBOMs.
Every hop between a line of source and a running process is something that can be substituted, and each hop needs a control and a way to verify it held.
A scanner tells you which known-vulnerable components are present. Whether any of them is exploitable in your system is a separate question, and conflating the two destroys the practice.
A trusted builder signs the artifact it produced, and the deployment refuses anything whose signature it cannot verify — the verification is the control, not the signature.
A machine-readable inventory of what is actually inside an artifact, generated at build time — the thing that turns "are we affected" from an investigation into a query.
CI is the most privileged system in the delivery path and the least reviewed — it can read every secret, write to the registry, and deploy to production.
Every downstream control attests to whatever the builder produced — so if the build environment can be influenced, signatures, SBOMs and provenance all faithfully describe a compromised artifact.