As I started working on my application I used hard coded api-keys in the code. When I moved it from my personal github to the companies private github I needed to remove these keys from the source code. I simply added a configuration file with this information where the contents are assumed to be unchanged, so that it doesn't push the api keys back to the repo.
Now there is a problem with running a docker image built using github actions. How would the dockerfile build the application with the correct api keys, when the github repository does not actually contain these keys? Only a local build from my computer would work.
What's a good practice to make this work?