How to protect secrets whilst enabling the ability to amend a pipeline
Developers or even admins of your GitHub repository wouldn't be able to see secrets configured there by default. Even if you debug GitHub Actions workflows and accidentally log secrets, GitHub would mark them with ***.

So the only attack vector I can think of is highly deliberate and it would require modifying GitHub Actions workflow code and egressing the secret outside to some pre-configured recipient on the Internet.

If you're worried about such attack vector beyond regular code reviews, you may try exploring CODEOWNERS as a way to protect .github directory - https://help.github.com/en/github/creating-cloning-and-archiving-repositories/about-code-owners.