Secrets

A deploy job that decrypts secrets for any push makes the encryption decorative. Hold the key in a deployment environment restricted to the default branch, and let a branch ruleset decide what reaches that branch.