The CI box gets its own deploy key, and it is read-only

Giving CI a copy of a developer’s key, or an account with write access, means a compromised build server can push to the repository — and a build server runs whatever is in a pull request.

ssh-keygen -t ed25519 -f ci_deploy -C 'ci@build-01' -N ''

# GitHub: repository → Settings → Deploy keys
# leave 'Allow write access' unchecked

A deploy key is scoped to one repository, which a personal key never is. Read-only is almost always sufficient — CI clones, builds and pushes artefacts somewhere else — and the exceptions, such as committing a version bump, are worth making explicit with a separate credential. Rotate it when someone leaves, which is a great deal easier than rotating a key that was shared.