I usually use a .env.example file which contains all non-secret variables filled and all secret variables defined with no value.

The secrets are stored in the secret store of GitHub/GitLab (depending on what I'm using). During deploy the .env.example file is copied to .env and all the secret variables are written into the file (which itself is in .gitignore to avoid accidentally committing the local version on my machine).

I use Ansible to deploy the docker-compose files around and do the typical operations (pull, restart, up/down). I store the secrets in my Ansible vault and it injects the secrets directly into the compose file when deploying the compose file to the host.

I add .env to my .gitignore, then I can safely put secrets in my .env. If you have a big .env file, make a sample.env with the secrets removed.

Ansible vault

You could have the best of both worlds and then also use GitHub secrets as well. https://github.com/marketplace/actions/deploy-a-portainer-stack

I use sops, usually with exec-env

Some random suggestions - it really depends on your deployment strategy and available infrastructure

• you can set secrets in portainer if you’re using docker swarm

https://docs.portainer.io/user/docker/secrets

• you can provide secrets to docker (unsure about portainer) on the command line when building

https://docs.docker.com/engine/reference/commandline/buildx_build/#secret

• Ive not used github actions but azure devops supports secret variables in libraries which can then be deployed via a pipeline without revealing any secrets, this appears similar on gh

https://docs.github.com/en/actions/security-guides/encrypted-secrets

• azure key vault and similar can store secrets which code then accesses, although you still then need to authenticate with the vault