If we make a private dir, inspectable only by user with right to write in defaultBranch we could add a file, à la .env containing secret variables for ci/plugins.
We could also use age to encrypt them but need to be decryptable by plugin. Maybe an access to plugin pub/priv ssh keys by project could do the trick.