Exactly, you never check passwords into version control. The github example is not to put a .env file into a repo but to add the secrets to github’s native secret manager, which is what actions use to read envs