A JavaScript action’s main step must pass a temporary directory path to its post cleanup script. After set-output/save-state deprecation, which mechanism should main use?

Actions with post: handlers often need values computed in main (temp paths, login handles). The supported pattern is appending to GITHUB_STATE (toolkit helpers write this for you). The legacy ::save-state:: workflow command is deprecated and should not be used for new work. Repository secrets are for credentials, not per-run temp paths. Matrix context is unrelated to action post state. Similarly, step outputs use GITHUB_OUTPUT for later steps in the job, while GITHUB_STATE is specifically for the action’s post phase. Migrating off deprecated commands clears warnings and aligns with current security guidance.