How to deploy a flutter web app on github that is using a .env without creating a security breach?

Question

I have a flutter web app and I want to deploy it on github pages.

But my app use an .env (which contains an api key) I pushed it encrypted with git secret.

To use github actions I use multiple secrets to replace the .env but I still cannot deploy the app without re-creating the .env and copying the secret values inside

So when I go the the gh-pages branch the key is still accessible...

I have this error when I go on my page =>

Failed to load resource: the server responded with a status of 404 () /ChatBox110bis/assets/.env:1

However, I already fix the href problem.

My github actions currently :

steps:
  - uses: actions/Checkout@v2

  - name: Create .env file
    run: |
      touch .env
      echo TYPE=${{ secrets.TYPE }} >> .env
      echo PROJECT_ID=${{ secrets.PROJECT_ID }} >> .env
      echo PRIVATE_KEY_ID=${{ secrets.PRIVATE_KEY_ID }} >> .env
      echo PRIVATE_KEY=${{ secrets.PRIVATE_KEY }} >> .env
      echo CLIENT_EMAIL=${{ secrets.CLIENT_EMAIL }} >> .env
      echo CLIENT_ID=${{ secrets.CLIENT_ID }} >> .env
      echo AUTH_URI=${{ secrets.AUTH_URI }} >> .env
      echo TOKEN_URI=${{ secrets.TOKEN_URI }} >> .env
      echo AUTH_PROVIDER_X509_CERT_URL=${{ secrets.AUTH_PROVIDER_X509_CERT_URL }} >> .env
      echo CLIENT_X509_CERT_URL=${{ secrets.CLIENT_X509_CERT_URL }} >> .env
      echo SPREADSHEET_ID=${{ secrets.SPREADSHEETID }} >> .env
      echo TITLE_FAQ=${{ secrets.TITLE_FAQ }} >> .env

  - uses: subosito/flutter-action@v2
  - uses: bluefireteam/flutter-gh-pages@v7
    with:
      baseHref: /ChatBox110bis/