How should secret keys be managed?

I created a web application using Ravel 8 and Firebase Authentication.
We have installed a json file downloaded from Firebase under resources/keys/ and are using it on the application side with reference to the following site:

Note that Ravel 6.0 was authenticated with Firebase's Twitter Outh authentication

.env

FIREBASE_CREDENTIALS=secret.json

config/firebase.php

<?php

return [
    'credentials' = > [
        'file' = > base_path(env('FIREBASE_CREDENTIALS')),
        'auto_discovery' = > true,
    ],
];

I don't know how to manage json for Firebase certification in Docker development and production environment.
I'm using github, but I think it's better to commit and push here, and if I push it, the actual production and Docker authentication json will be the same.

Is there a way to separate and manage authentication json for each environment?
I would appreciate it if you could let me know.

Thank you for your cooperation.