Yep +1 on this. I started to look into implementing this on a project but we too are not ok with giving Github access.

On deploy posting the Gemfile is something that came to my mind too and would work.