I just started adding Google Analytics to my GitHub Pages site, which calls for putting it in the
_config.yml file. Is it insecure to keep the
_config.yml file in my public GitHub repository, or is it ok to keep it uploaded there?
Google Analytics tags are already public (very public, in fact), so there's no need to keep it secret.
Since you're using Jekyll, the Google Analytics tag that you put in
_config.yml will be included in the source code of every page on your compiled website anyways. This is how Google Analytics is able to track everything.
In short, there is nothing insecure about this and no need to worry. It's a public number.