[Discussion] What is your preferred method for managing environment variables across different deployment environments?

I have been juggling .env files, Docker compose env sections, and CI/CD secrets recently — each has a specific use case but they start to conflict as complexity grows. My current setup: local development uses .env with a gitignore; staging pulls from AWS Secrets Manager injected via Task Definition; production uses the same SSM parameter store path with stricter IAM policies. The main pain point is keeping these in sync when schema changes occur — adding a new variable requires updating four places before it works end-to-end. Has anyone found a templating approach or an orchestration tool that handles cross-environment key validation?

My approach has evolved through a few stages:

1. Early days: .env files checked into git (obviously bad, but I learned early). Then dotenv-safe for templating with .env.example. Still messy at scale because you end up copy-pasting the same keys across five services.

2. Intermediate: Separate .env.[stage] files per environment, loaded conditionally by an entrypoint script. Better, but now you have a security problem — any dev who can run the app can read prod secrets if they're in the repo at all.

3. Current standard (what I recommend for most teams):

• Development: direnv + .envrc. Keeps environment variables scoped to directories and auto-loaded when you cd in/out. Typed with shell autocomplete so you know what keys exist without checking a wiki.
• CI: GitHub Actions secrets / GitLab CI masked vars. Inject at the