I think developers want to set it in one place and have it 'just work' whenever a branch is pushed. We could bundle web hooks / CI/CD config that doesn't live in the git repo into either a new event or the repo announcement. We could potentially encrypt secrets nip44 style to the pubkey of the a selected grasp operator.