If you really must have that file under version control, use a git attribute filter driver (see also GitPro book).
A filter driver consists of a clean
command and a smudge
command, either of which can be left unspecified.
Upon checkout
, when the smudge
command is specified, the command is fed the blob object from its standard input, and its standard output is used to update the worktree file.
Similarly, the clean
command is used to convert the contents of worktree file upon check-in.
That way, the script (a private version, only in your repo, not managed by Git) referenced by the smudge can replace the coded URL, while the clean script will restore its content to a coded URL.
A public version of the same script, managed by git and pushed everywhere would do... nothing and keep the URL obfuscated.