Collections are forged in building stage, is authToken bundled into build artifact?

[slow-groovin]

My source is source is conditionally set based on a environment variable.
Log of buildSource() only appears in building stage, means that collections are forged on building stage.
So if authToken is need, is it true that authToken must be bundled into build artifact?

const buildSource = (path: string) => {
  const contentSource=process.env.CONTENT_SOURCE
  if(contentSource!=='local' && contentSource!=='github'){
    console.error('CONTENT_SOURCE must be "local" or "github")
  }
  console.log('contentSource:',contentSource)
  const source = process.env.CONTENT_SOURCE !== 'github' ? path : {
    repository: process.env.REMOTE_CONTENT_REPO,
    include: path,
    prefix: '/',
    authToken: process.env.GITHUB_AUTH_TOKEN,
  }
  return source
}

export default defineContentConfig({
  collections: {
    blog: defineCollection({
      type: 'page',
      source: buildSource('blog/**/*.md'),
      schema: z.object({
        date: z.date(),
      })
    }),

[slow-groovin]

Oh, I always thought that configuring GitHub as the source would allow the collection to be dynamically fetched and updated. But it seems that the collection is fixed at build time.