could you just source vars from an .env file? maybe a bit more work to get the secrets pulled down. i guess ideally you'd want to be able to pull those values directly from github as an option (including secrets) if that's your primary source of truth.