Buildkite[1]. You never give them any secrets. It is essentially a frontend for agents that live on your infrastructure in the cloud, e.g. AWS. The company I work for does the CI runs on spot instances which is perfect for this kind of interruptible work.

[1] https://buildkite.com/