The 'core-updates' and 'staging' branches shouldn't trigger evaluations
at each commit, because they produce too many derivations.  Instead, the
admins should have a 'trigger evaluation' button that they use once in a
while.  That button should be part of an 'admin interface', which should
be protected by NGINX's 'auth_basic' authentication mechanism.