Private and public Git repositories with sensitive data

Question

I have a service currently running on Heroku .
The way deployment works with Heroku is that you push the code to a git repository, which triggers a build and subsequently a deployment of the new code.
Since this is the only way to deploy your service to Heroku, that git repository contains a lot of sensitive information, such as tokens and client secrets in a few config files. Because of this, the repository is currently a private repository, but I would like to make it into a public one.

Normally I'd just .gitignore the config files and exclude them entierly, but since committing the files is the only way to get them to Heroku, I can't do that.

I figured I could solve this issue by having two branches that I would simply push to different remotes, where one was the private one going to Heroku, and one was a public one on GitHub.

During development I'd push to the private branch and then merge those changes (minus the configs) to the public branch and all would be well. Unfortunately doing it this way caused the merge to include all the history from the private branch, which would include the sensitive data, so that is a no-go.

Is it possible to do this some other way?

I'm also open to alternative solutions.
How are these situations usually solved?
I feel like this can't really be a unique situation.

Answer 1

You can use Heroku's Config Vars to store your sensitive data. You'll be able to access the data as environment variables from your code.

Most cloud hosting services these days give you the ability to set environment variables and it's considered good practice to use it for sensitive values.

As an example, you can set an environment variable using the heroku cli like this:

heroku config:set GITHUB_USERNAME=joesmith

Most programming languages provide a way to access environment variables. For example, with Python you could use:

import os
print(os.environ['GITHUB_USERNAME'])

Wherever you currently use your sensitive data, you could then just replace it with the environment variables.

Another advantage of environment variables is that they are ubiquitous. Almost every operating system and cloud service supports them, so they would be one less thing to worry about if you want open source your project and support as many platforms as possible.