Never hard-code credentials. Environment-scoped secrets plus required reviewers gate prod. Even better, use OIDC (permissions: id-token: write) to exchange a short-lived token with AWS/GCP/Azure, eliminating stored static keys. Set the default GITHUB_TOKEN to least privilege with permissions:.

Code Example

permissions:
  id-token: write
  contents: read

💡

Interview Tip

OIDC over static keys is the modern best-practice answer.

github-actionssecretsoidc

New to GitHub Actions? Start with the GitHub Actions: Zero to Hero guide.

Read the tutorial →

How should you handle secrets and cloud credentials in Actions securely?

More GitHub Actions questions