I do wonder here whether the core problem here is that github is outside your firewall, and so you are always one secret leakage/misconfiguration away from disaster.