Comment by jamescrowley

You actually don’t need (long-lived / hard-coded) secrets in this scenario if you use OIDC:

https://docs.github.com/en/actions/how-tos/secure-your-work/...