Use a private dev repo and do all your dev inside it.

Releases go to a seperate public repo

In the private dev repo use a script which Cherry picks release files from a whitelist that you maintain in the public repo.

Essentially, you define the files and folder structure of a release and that ensures every release looks great with no cruft and it's never going to have .secret.json in or whatever

Hardcoded secrets is seperate and you can have another script to grep for those