Definitely a no-go to release a shadowed patch underneath the hood. Nobody does expect this kind of behaviour when running their daily CI’s.
How can someone even rely upon having deterministic builds for their products if patches are shipped silently. Additionally it makes debugging even harder if something accidently go wrong for pipeline execution.