I thought that at this point it’s common sense that any secret pushed to a public GitHub repo should be considered compromised, regardless of how quick you roll it back.

There are many people writing automated tools doing their best to catch slip-ups like this before everyone else. Dark Forest and all that.

And as someone else said, why use a wallet holding mainnet private funds as a dev wallet? Separate your keys.