any tips on how to manage secrets locally? I've got graphcool.yml using the

${env:SECRET_VAR}

syntax... just not sure of a solution that can be used to provision secrets locally & on the CI server?

use environments variables? like

.envrc

+ direnv locally, and environment variables in whichever mechanism your CI allows