There are many instances where a development team, at least my team, want a smooth development to production pipeline with a version tracked theme. Manually, this is possible with Git and Plone Theme Uploader, which developer would pull the latest changes and execute the upload command or upload the theme via the theme control panel. The problem is, someone has to do it from the command line or manually zip it and upload it.
The Big Picture
A developer pushes the changes for the theme to the git repository.
The CI / CD tests the changes or other developers review the changes.
Once approved by other developers or the CI / CD, the changes merged into master.
Once merged, the lead developer can deploy the changes to the plone site by creating a new tag.
The Solution
Create a private gitlab variable by going to your CI / CD settings (https://gitlab.com//settings/ci_cd)
Expand the variable collapsed content, and enter your plonekey has the key and the content of .plonetheme-upload-cookie has the value. Afterwards, click save variables.
Just as David said, You can store the credentials as Gitlab variables.
In a previous project, I was skeptical about storing credentials as a Gitlab variable. I went to the lenght of storing the credentials as files inside of a password protected zip file, which was located in another password protected zip file. The gitlab variable that I had stored, was used to unzip the parent zip file, then was used with a salt factor + MD5 to unzip the folder with the credentials.
Yes, it was an overkill and too complicated. However, it was an alternative if vanilla Gitlab variable is an security issue.
Currently, I'm using vanilla Gitlab variable for the credentials and cookie.