Custom environment variables seem to be the way for this, as per the docs:
In addition to Xcode and macOS versions, you can set custom environment variables for a workflow in its Environment section. These variables are available to custom build scripts you use to extend workflows. For example, set a secret environment variable to contain an API key you use in a custom build script that uploads a workflow’s artifacts to your server.
Important
To securely store an environment variable and make sure it doesn’t appear in any logs, select the Secret checkbox.
https://developer.apple.com/documentation/xcode/xcode-cloud-workflow-reference#Custom-environment-variables
Topic:
Developer Tools & Services
SubTopic:
Xcode Cloud
Tags: