Secret was inserted directly into Gitea MySQL database. Checkout now uses simple authenticated curl to download archive.