I typically add a "bootstrap" project to CCNet that watches the config file itself for changes (as it's in source control).
The build gets this file, runs the ccnet console with -verify and only copies the new config file into place on the build server if the build verifies. While this doesn't make the build unbreakable, it does make some changes quite a bit safer than just "svn up" on top of the live config file. I can provide sample project code if you want. -Adam Vandenberg http://adamv.com/
