When creating a ci/cd pipeline for your project, at some point you have to define a connection to your environment. In case of Dataverse, the connection string will contain clientid and client secret values. It's always a good idea to store secret values in a secure place, instead of putting them in clear text into your pipeline definition file (yaml) and potentially pushing them into your code repository.
Azure DevOps provides you a number of possible solutions to address just that:
When working with CRM Package Deployer, it always does an "Upgrade" process while importing a new solution. Please check out this post to find out more about the different solution update processes: