How securely to keep google cloud service account key? How securely to keep google cloud service account key?

I want to ask about how we should securely keep service account key. The scenario looks like:


Our product is connecting to BigQuery. 
We have project which is used only by developers as playground.  
We need to run integration tests in pipelines and they needs service account to run correctly.
Developer also should be able to run integration tests locally.


Where should I put the service account key? 

I can add it to our repository, but I'm not sure if this solution is ok. (even it is only key with read-only permission to developer version of BigQuery).

The second solution is create a few keys. And every developer should has own. Then every developer have to care about key himself (and we can easy remove key when developer i.e quit job)
I would recommend you use their Google Cloud Secrets Engine. Documentation is here: https://www.vaultproject.io/docs/secrets/gcp/index.html

Managing such sensitive secrets by any means other than a Vault service is dangerous.