How should GitHub Actions workflows be designed for production?

For production, grant minimal permissions, pin or review third-party actions, use environments for protected deployments, cache safely, separate trusted and untrusted code paths, and keep workflows reusable where duplication is high. Add automated tests and observability around the critical behavior, document ownership and failure handling, and review the design when traffic, dependencies, or security requirements change.