The correct option is Set env in the workflow YAML because defining environment variables at the top level of a workflow makes them available to every job and step in that single run.
In a workflow file you can declare a top level mapping for environment variables with key value pairs. This top level scope propagates the values to all jobs and steps in the run and you can override them at job or step scope when necessary. This is the most direct way to share non secret configuration across the entire workflow execution.

Use keywords strategy and matrix in that order.
Last line should be node-version: ${{ matrix.node-ver}}
Reference:
https://docs.github.com/en/actions/how-tos/write-workflows/choose-what-workflows-do/run-job- variations

GitHub secrets are used to securely store sensitive information like API keys, tokens, and passwords in repositories. When you store the sensitive information as a GitHub secret, you remove the need to hardcode the credential or key, and prevent exposure of it in your code or logs. The secret can then be used to authenticate services, manage credentials, and securely pass sensitive data in workflows.
Note: For GitHub, you can use a personal access token, an OAuth app, a Secrets Manager secret, or a GitHub App connection to access the source provider. For GitHub Enterprise Server, you can use a personal access token, a Secrets Manager secret, or a GitHub App connection to access the source provider.
Reference:
https://docs.github.com/en/code-security/getting-started/understanding-github-secret-types

Input parameters for the cache action
[C] key: Required The key created when saving a cache and the key used to search for a cache.
It can be any combination of variables, context values, static strings, and functions. Keys have a maximum length of 512 characters, and keys longer than the maximum length will cause the action to fail.
[A] path: Required The path(s) on the runner to cache or restore.
Reference:
https://docs.github.com/en/actions/reference/workflows-and-actions/dependency-caching

Creating a JavaScript action, example
Prerequisites
Before you begin, you'll need to download Node.js and create a public GitHub repository.
* steps omitted *
From your terminal, initialize the directory with npm to generate a package.json file.
npm init -y
Adding actions toolkit packages
The actions toolkit is a collection of Node.js packages that allow you to quickly build JavaScript actions with more consistency.
When you commit and push your code, your updated repository should look like this:
hello-world-javascript-action/
─ action.yml
─ dist/
─ index.js
─ package.json
─ package-lock.json
─ README.md
─ rollup.config.js
─ src/
─ index.js
Reference:
https://docs.github.com/en/actions/tutorials/create-actions/create-a-javascript-action#creating-an- action-metadata-file