A workflow needs a deployment credential without committing it in YAML. Which mechanisms help? Select 2 answers.

1. Print the credential to the job log for debugging
2. Put the credential in the README and hide the heading
3. Store the value in an appropriate Actions secret
4. Limit workflow permissions and secret availability