Yes, you’re correct. Credentials should never be in repo.

This can be achieved by get a token for CI operations (step 1) and set the token as a GitLab environment variables (step 2)