What about setting secrets in env vars? E.g., gitlab ci env variables.