I might get a ton of hate here. But just use jenkins [if you cannot use modern tools like GHA]. Put it on a port 8085 for example, go to your cloud providers security rules, block all requests to port 8085 that are not using a VPN. Sleep like a baby at night. The end.