Wouldn't the dropper get executed once tests are run within CI though?
Yes, you should separate "tests execute" into their own unprivileged workflows that don't have "deploy" secrets.
loading story #49170925
yeah, or when a dev starts the local development server (unless that server is containerized).
loading story #49170716