Outside of locking down edit access to the .github workflow yml files I'm not sure how vulnerabilities like this can be prevented.
Presumably anything configured via a .github workflow wouldn't assure safety, as those files can be edited to trigger unexpected actions like deploys on working branches. Our Github Action workflow yml file had a check to only deploy for changes to the main branch. The deploy got triggered because that check got removed from the workflow file in a commit on a working branch.
But for actually good security CI and CD should be different tools.
You create an environment, restrict it to the main branch, add your secret to it and then tie your deploy workflow to it.
If someone runs that workflow against another branch it will run but it won’t be able to access those secrets.
[0] https://docs.github.com/en/actions/managing-workflow-runs-an...
The problem is it's still possible to work around those controls unless you create some YAML monstrosity that stops people from making the mistake in the first place.