Reproducible builds and secrets (api keys, passwords, etc.)
Recently I've published 2 Android apps to FDroid with the 'Reproducible Builds' feature enabled.
Now I want to add a Crash Reporter to my app in the next releases (for example, I am already familiar with ACRA). Of course, I don't want to store API keys in source code. I will store them in a GitHub secret environment (to make it harder for an attacker to get secrets).
Does this mean my build will no longer be reproducible? FDroid doesn't know secrets and the final APK will be different.
Are there any recommendations to work with secrets in the context of Reproducible Builds? Is there any place to store environment secrets on FDroid server?