Yes, you should separate "tests execute" into their own unprivileged workflows that don't have "deploy" secrets.
You can also do the same for the build workflow, no?
Yep, I'd recommend it.
You can also do the same for the build workflow, no?
Yep, I'd recommend it.