Idea (might already work like this, but needs documenting): `run: ./vendor/bin/config-generate deploy stripe.pub="${{ secrets.stripe_pub }}"` stripe.private="${{ secrets.stripe_private }}"`