Have you guys ever dabbled with Nix? I have found that it excels at this sort of thing (i.e. dev/ci determinism/reproducibility).

There is agreat blog post that was written primarily about building Docker images using Nix, but the sentiment applies to CI in general. But alas I am heavily invested and thus heavily biased :D

Anyways, if you are interested I'd be more than happy to discuss in detail with you. Or even if you aren't but are nonetheless curious! Thought I'd toss it out there considering I just went through a similar exercise in a repository of my own.