Actions secrets and variables

Keep credentials out of workflow files

API keys, deployment credentials and other sensitive values should be stored as GitHub Actions secrets or through an appropriate external secret system. Never hard-code credentials into workflow YAML.

Secrets versus normal variables

Use secrets for sensitive values. Normal configuration values that are safe to expose can be stored as variables or directly in workflow configuration.

Least privilege

Give workflows only the permissions they need. Review the permissions granted to the GITHUB_TOKEN and avoid granting write access when read access is sufficient.