Wouldn't this be an unwinnable battle? If you can't print out the whole secret, you can print out each half of it, or one character at a time, each on a different line.

There's probably no way around the reality that users who have the ability to run arbitrary code on the CI server have access to the secrets.