Lint
YAML, shell, policy and guard regression suites.
GitLab CI/CD · OIDC · safe-deploy
Five stages, zero standing credentials.
This page is published by the same pipeline that linted it, scanned it for secrets, built it, deployed it behind deletion guards, and then verified the bytes that the environment actually serves.
Security
Credential scanner plus Semgrep SAST, fail-closed.
Build
Digest manifest binds every byte to this commit.
Safe-Deploy
OIDC → STS, deletion plan, mass-delete circuit breaker.
Smoke
Objects and HTTP verified against the manifest.