# Step 8 -- GitHub CI Validation

## Goal

Reject obviously broken IaC without building a production customer
deployment platform.

## Initial PR Checks

-   Bicep build
-   Bicep lint
-   PowerShell checks
-   Required-file checks
-   Security scanning later when selected

``` text
Feature branch → PR → build/lint/checks → human review → main
```

## Do Not Add Yet

Automatic customer deployment, broad Azure credentials, automatic
remediation, or multi-customer matrix deployment.

## Decisions

Runner type, OIDC federation, approvals, security scanning, and internal
test environment.