How to *safely* install a python private package from github in an AWS EMR bootstrap script

Question

I want to install a Python3 package from a private Github repository onto an AWS EMR Spark cluster.

I know how to do this the dirty way by hardcoding credentials but