A GitHub Actions workflow requires a 256-KB secret that must be accessible only to the workflow and with minimal administrative overhead. Which approach do you recommend?

The correct approach is to encrypt the secret, store the ciphertext in the repository, and keep the decryption key in repository-level GitHub secrets. GitHub secrets have a size limit of 64 KB. Since the secret is 256 KB, it cannot be stored directly in GitHub secrets at either the repository or organization level. Encrypting the secret and storing the ciphertext in the repository allows you to bypass the size limit, as the ciphertext can be committed like any other file. The decryption key, being small, can then be securely stored in repository-level GitHub secrets, making it accessible only to workflows within that repository and minimizing administrative overhead compared to organization-level secrets if the secret is specific to one repository.