Yes, you should separate "tests execute" into their own unprivileged workflows that don't have "deploy" secrets.
You can also do the same for the build workflow, no?
alt Hacker News
You can also do the same for the build workflow, no?