Only decrypt deploy key in travis cronjobs

.travis.yml

@@ -1,10 +1,5 @@
 language: nix
 before_install:
-  - openssl aes-256-cbc -K $encrypted_025d6e877aa4_key -iv $encrypted_025d6e877aa4_iv -in ci/deploy_key.enc -out deploy_key -d
-  - chmod 600 deploy_key
-  - eval "$(ssh-agent -s)"
-  - ssh-add deploy_key
-  - rm deploy_key
   - source ~/virtualenv/python3.6/bin/activate
 script:
   - bash ci/deploy.sh

ci/deploy.sh

@@ -2,6 +2,18 @@
 
 set -eux -o pipefail # Exit with nonzero exit code if anything fails
 
+if [[ "$TRAVIS_EVENT_TYPE" == "cron" ]]; then
+  openssl aes-256-cbc -K $encrypted_025d6e877aa4_key -iv $encrypted_025d6e877aa4_iv -in ci/deploy_key.enc -out deploy_key -d
+  chmod 600 deploy_key
+  eval "$(ssh-agent -s)"
+  ssh-add deploy_key
+
+  # better safe then sorry
+  rm deploy_key
+fi
+
+unset encrypted_025d6e877aa4_key encrypted_025d6e877aa4_iv
+
 python ./nur/update.py
 nix-build