As @schmidsi from @ensdomains explains, GitHub commits upload to Filecoin Onchain Cloud and surface as @safe transactions to update the ENS content hash. Safe owners review each change before it moves onchain. Only multisig-approved updates go live, securing DeFi front ends.