push secrets.yml to github, use env vars for production