Automation frequently sets 'StrictHostKeyChecking no' to get past the interactive fingerprint prompt. That setting accepts an unknown host key and, just as importantly, keeps connecting when a known host key changes, which is exactly the machine-in-the-middle case the check exists to catch.
OpenSSH 7.6, released in October 2017, added the 'accept-new' value. It automatically accepts and records a key for a host that is not yet in known_hosts, but still refuses to connect if a recorded key changes. For ephemeral CI runners talking to freshly created VMs, that is almost always the intended behaviour.
The stronger option is to distribute known_hosts out of band, or to use an SSH certificate authority so one CA key in known_hosts with a @cert-authority line validates every host. When a legitimate key change does occur, remove the stale entry with 'ssh-keygen -R hostname' rather than editing the file, because entries may be hashed and the hostname will not appear in plain text. Pairing accept-new with UserKnownHostsFile pointing at /dev/null defeats the entire point, since nothing is remembered between runs.