I have figured out a way to solve the problem I had, simply put I separated production repo and workdirectory repo, then in production repo added two branches one to pull from github and other to push to heroku, then added merge exclusion rules from pull branch to production branchhere is the steps

=== Creating two separate git repos

The first is the workdirectory

The second is the production directory that I create separately

In workdirectory directory:

1. Clone the github repos
2. add "path/sensitvefile" to .gitignore file in all branches, commit and push
3. put the sensitvefile in workdirectory and make sure that git didn't detect any change by `git status

-now the sensitvefile will be ignored, let's go to production repo that I created earlier

1. create a heroku-branch called heroku-prod
2. create a master-branch called master
3. add remote github repo git remote add github remoteGithubUrlHere.git
4. add remote heroku repo git remote add heroku remoteHerokuUrlHere.git

=== adding merge exclusion in heroku folder

1. add a merge driver called ours in global git config

   git config --global merge.ours.driver true

2. add exclusion in heroku-branch

   git checkout heroku-prodadd ".gitignore merge=ours" to .gitattributesadd ".gitattributes merge=ours" to .gitattributes, then commit changes.

publishing steps

1- pull from github

git checkout mastergit pull github master

2- merge master-branch to heroku-branch

git checkout heroku-prodgit merge master

3- push to heroku

git checkout heroku-prodgit push -u heroku heroku-prod

======= Important Note

any change in .gitignore or .gitattributes will be ignored on merge master-branch to heroku-branch, so if there any change in this file, the change have to:

• Be manually edited.
• Or Temporarily remove merge exclusion in '.gitattributes' file and keep sensitive files away then merge, then return merge exclusion in '.gitattributes'