Wouldn't the dropper get executed once tests are run within CI though?

Yes, you should separate "tests execute" into their own unprivileged workflows that don't have "deploy" secrets.

	▲	rcxdude 5 minutes ago \| parent [-]
		You can also do the same for the build workflow, no?

jitl an hour ago | parent | prev [-]

yeah, or when a dev starts the local development server (unless that server is containerized).

	▲	insanitybit 20 minutes ago \| parent [-]
		Dev laptops tend to have better monitoring than CI/CD so I still think this is a better option. You can also have devs use VMs or separate dev environments like an ec2 instance. To be clear, just solving the CI/CD portion is insufficient, but it is a massive win.