We could also use the deploy-secrets file; here we use `ENV["branch"]` for consistency with other environments.