Best CI flow for sensitive health data APIs?

I'm developing a python package that unifies wearable device APIs (the abstraction is you tell the library which device you're interested in, give it creds, and then extract your data without learning device-specific APIs)

We're planning to make this open-source. Is it possible to have CI be automatic on each PR or is it doomed to be manually approved each time for security reasons?

For more details, the threat vector i'm considering is a malicious PR leaks our creds either …

apis cybersecurity data flow health health data