Tech Lead of Google Registry ( https://registry.google ) here. We run on GCP.

You definitely don't want to check secrets into the repo for the same reason you don't set them as environment variables: It's not secure. The solution is to use Cloud Key Management Service. More info here: https://cloud.google.com/kms/ We use that to either store secrets directly, or to decrypt encrypted entities in a DB (e.g. Datastore).

You can see how we use it here (our project is open source): https://github.com/google/nomulus/tree/master/java/google/re...