I think what you need to ask yourself is:
If the key gets compromised, can I detect it?
How does the revoking process affect other people?
For example: what if the internal source control repo is taken outside of the company perimeter, e.g. via a developers' laptop? What if this laptop is stolen? What if it's a disgruntled employee that makes a copy and keeps it on their personal laptop?
In other words, can the key be used to access a public resource and if so what is the damage?
If your development practices require the sharing of a private key, then it is not a private key by definition. You might want to think about why this is happening and whether you should consider per-user access token (e.g. oAuth, an API key) or other solutions.