This kind of thing always makes me sweat. Are deletes at all possible? What if someone accidentally pushes keys to the repo? On regular github, at least you can nuke the whole repo and start over if need be.
At which point you may as well leave them there...
You may get lucky and remove/hide it fast enough, or think you did...
This is an with Github today, all public repos are being watched by bots reviewing all commits for accidentally-pushed credentials.
The only solution is to not use a public repo.
On GitHub yes someone might be watching, but deletes are still possible.