eas secrets it’s exactly what you need, it works pretty much the same as in every other ci service, if you need the file just restore from env in preinstall step, I recommend keeping it base64 encoded
e.g. echo "$SOME_ENV_VARIABLE" | base64 -d > google-service.json