Start here. This is the direct spoken answer to practice first.
Why this question matters
A release can be compromised even when the application code is correct. Dependencies, reusable actions, build runners, credentials, registries, and artifact substitution all sit on the path from commit to production.
I would protect branches and reviews, pin package and workflow dependencies, use lock files, and scan source, dependencies, and images for known vulnerabilities and leaked secrets. Pipeline tokens receive the minimum permissions for each job, and deployments use short-lived federated identity where possible instead of long-lived cloud credentials. The pipeline builds once, stores an immutable artifact with its commit identity and hash, and promotes that same artifact rather than rebuilding production from source.