We are using a Continuous Integration service to automatically run our product test suite. Every time we push code to our central Git repository production branch, the CI services is notified and fetches the code to run the test suite.
The CI service allows us to write a post build script which can automatically push the code to our Heroku production server when the tests pass.
However we fear that if an attacker breaks into the CI service, he can then push any code change he wants to our production server.
We plan to change this architecture to have the CI service ping a specific 'deploy' server of ours when the tests pass. This 'deploy' server would fetch the latest production branch code from our central Git repository and the push to our Heroku production server.
This way, if the CI service is compromised, an attacker could not push from the CI service any code he wants to our production server. He would have to break into our 'deploy' server.
The goal of this new architecture is to move the risk from the CI SaaS to a server of ours. The Heroku credentials necessary to deploy are no more hosted on the CI SaaS but on a server of ours.
Does it make sense? Or is there any other simpler alternative when using a CI service (apart of setting up and securing one's own CI server)?