GitHub Actions runs it end to end; a failed typecheck never reaches production.
The build prerenders every route, generates the sitemap from the built HTML, then
hashes every inline script into the Content-Security-Policy so nothing ships unpinned.
Push to main. Minutes later it's live, indexed, and pinned. No servers, no ceremony.