I am wondering why not just rsyncrypt the source code before pushing to the repo?

https://manpages.ubuntu.com/manpages/focal/man1/rsyncrypto.1...