Where are LineageOS nightlies compiled & Who has commit rights to the codebase? A] Where are LineageOS nightlies compiled?

1) Are they compiled on maintainer's machines
2) On a project controlled build farm?
3) Pool of contributed (random) machines?

B] Who has commit rights to the codebase? Is that tightly controlled or is it easy for rouge commits or rouge maintainers to enter the project?

Note: I am trying to determine if I got SMS spam shortly after installing LOS.  I am trying to determine the security of the Lineage OS contribution and
CyanogenMod (the ancestor of LineageOS) compiles nightlies on its own build farm, but now without the backing of a corporate, LineageOS pay for 3rd-party servers. See costs here.

Among all AOSP-based ROMs, LineageOS has argulably the most strict standard for accepting a device into official queue, including a recently composed charter. A list of contributers / device maintainers can be seen here. Moreover, there's also a complete code review system that guarantees the non-malicious nature of commits.

On top of all above, all the device-dependent and -independent sources, sans Google apps, can be found on their GitHub. This might sound natural, but do note that for a lot of other ROMs, even if an "official" moniker is given to a device, its sources aren't necessarily readily available or easy to find.

Feel free to review the code on your own if you suspect a security breach.