Is github the master, or a sync from somewhere else? Are the commits GPG signed? Does anyone here know for a fact the build/test pipeline(s) validate on checkout that git has no errors and require human intervention if it does?