Storing the secret on a hardware token will most certainly help with not committing into source control.

Most use another build host siloed from the dev staging area, regression tested/audited, and with limited administrative access. =3

Ye, and how do you get source code from devs into that silo?

	▲	Joel_Mckay a day ago \| parent [-]
		Usually set up a custom build-bot that pulled a named branch into a VM with a read-only backing image. Had to be done that way for a number of reasons, but mainly simplified dealing with fussy fragile cross-platform build/test environments. I should also add even simple visgrep and xdotool can automate a lot of checks that normally takes hours of repetitive testing. Best of luck =3