Add secrets for CI against canonical repo