[Question] How would a deployment server decrypt a file? Assuming it's a `.env` file

hi there, I'm completely new to git-crypt.

I read an article about this git-crypt and I have a question. Suppose I use git-crypt to encrypt a `.env` file for production environment secrets. I push it to my github repo.

My deployment server would typically run a git pull and it has the deploy key stored on the same GitHub repo ensuring it's read-only.

Now how would the deployment server decrypt the `.env` correctly?