I've settled on a solution for this that I'm happy enough with. Alongside my nginx container I'm running an Rsync daemon container with shared volumes. Now any runner on the local network can sync files.

First I put the password into a file:

- echo "$RSYNC_PASS" > /rsync_pass
- chmod 600 /rsync_pass

Then build my Hugo site and sync:

- rsync -av --delete public/ --password-file=/rsync_pass rsync://$RSYNC_USER@$PRODUCTION_IP/data$PRODUCTION_DIR