How should GitHub Actions secrets be designed for production?

For production, prefer federated identity such as OIDC over long-lived cloud keys, scope secrets to the smallest environment, mask outputs, restrict deployment environments, and rotate credentials when exposure is suspected. Add automated tests and observability around the critical behavior, document ownership and failure handling, and review the design when traffic, dependencies, or security requirements change.