Building custom GitHub Actions safely

Description

Build, publish and review custom GitHub Actions - choosing JavaScript/TypeScript, composite or Docker actions, writing action.yml (inputs, outputs, runs.using node24, pre/post steps, branding), handling secrets and tokens inside an action safely (inputs, core.setSecret, least-privilege tokens), bundling with ncc/esbuild, testing, versioning with immutable releases and major tags, and Marketplace publishing - with a security analysis of secrets and variables. Use whenever the user wants to create an action, write action.yml, turn repeated workflow steps into a reusable action, publish to the Marketplace, fix "Unable to resolve action", or review a custom action's security - even if they only say "make this step reusable".