We currently upload secrets before deploying the script, but this understandably will fail if the script has never been deployed yet. We should think about how to prevent this, e.g. "touch" the script if we get a 404 response and retry.