Yes, you should separate "tests execute" into their own unprivileged workflows that don't have "deploy" secrets.
replyYou can also do the same for the build workflow, no?
replyYep, I'd recommend it.
replyyeah, or when a dev starts the local development server (unless that server is containerized).
replyDev laptops tend to have better monitoring than CI/CD so I still think this is a better option. You can also have devs use VMs or separate dev environments like an ec2 instance.
replyTo be clear, just solving the CI/CD portion is insufficient, but it is a massive win.