Haven't done it myself, but I would probably have a git post-receive hook trigger a service (jenkins?) to pull down and decrypt the secret repo and update vault