fix(build): decrypt credentials only on master