Secure pipeline configuration files

Hello,
we're planning to use pipelines to deploy to Salesforce.
My concern is that pipeline configuration files stored in each branch, containing the target Salesforce environment, could potentially be updated through a Pull Request: even if I am the only one allowed to merge on our UAT and Production environments, if a developer makes a mistake and pushes a change to a pipeline configuration file via Pull Request and I fail to identify it among the list of changes, we could end up in a situation in which I run the deployment pipeline for UAT but, instead, the content gets deployed to Salesforce Production.
We'd therefore need to have something that makes files read-only in a branch, or have some feature that, for instance, prevents from merging a Pull Request if it lists a change on a particular file.