When we've set this up in the past, it was a bit of a pain to have local envs, and cloud envs, and the build system needs to get the cloud ones, etc. etc.
You can then commit all the config (including the secret identifiers) and it all just works so long as you're authenticated with your secret storage system.
We do this for the live configuration as well in line with Gitops and find it to work well.
If you don't want to use a cloud secret manager you can also use something like https://github.com/getsops/sops to commit the encrypted secrets safely
Though I could see adding “teams” features to shello that help with syncing and cloud environments