Your GitOps Pipeline is a Lie Until You Prove Otherwise

You use ArgoCD. Your manifests live in Git. Every change is a PR. You feel secure. But here's the question nobody in the GitOps world wants to answer: how do you know the image running in your cluster