only deploy from master, round 2

hopefully without exposing secrets this time.