Comment by Kinrany

CI shouldn't do deployments, deployment pipelines should run separately when a new release passes CI

Of course the general purpose task runner that both run on does need to support secrets