How would you answer an interview scenario involving GitHub Actions secrets?

In an interview, I would first define GitHub Actions secrets and the problem it solves, then explain how I would prefer federated identity such as OIDC over long-lived cloud keys, scope secrets to the smallest environment, mask outputs, restrict deployment environments, and rotate credentials when exposure is suspected. I would also call out the main failure mode: placing secrets in logs, artifacts, command output, or workflows that run untrusted contributions can leak credentials even though the value is stored in the secrets feature. Finally, I would describe how I would test, monitor, and safely roll back or recover the solution.