How should I handle configuration and secrets in GitHub Actions?

Use minimal workflow permissions and OpenID Connect for short-lived cloud credentials where possible. Restrict production environments and secrets to approved deployment jobs. Avoid interpolating untrusted event text directly into shell commands; pass it as data through an environment variable instead.