Yes, you should separate "tests execute" into their own unprivileged workflows that don't have "deploy" secrets.

You can also do the same for the build workflow, no?

	▲	insanitybit 13 minutes ago \| parent [-]
		Yep, I'd recommend it.