Clarify vars and secrets context availability in composite actions

content/actions/reference/workflows-and-actions/contexts.md

@@ -343,7 +343,7 @@ jobs:
 
 ## `vars` context
 
-The `vars` context contains custom configuration variables set at the organization, repository, and environment levels. For more information about defining configuration variables for use in multiple workflows, see [AUTOTITLE](/actions/how-tos/write-workflows/choose-what-workflows-do/use-variables#defining-configuration-variables-for-multiple-workflows).
+The `vars` context contains custom configuration variables set at the organization, repository, and environment levels. The `vars` context is not available for composite actions. If you want to pass a configuration variable to a composite action, you need to do it explicitly as an input. For more information about configuration variables, see [AUTOTITLE](/actions/how-tos/write-workflows/choose-what-workflows-do/use-variables#defining-configuration-variables-for-multiple-workflows).
 
 ### Example contents of the `vars` context
 

content/actions/reference/workflows-and-actions/metadata-syntax.md

@@ -61,7 +61,7 @@ inputs:
 
 When you specify an input, {% data variables.product.prodname_dotcom %} creates an environment variable for the input with the name `INPUT_<VARIABLE_NAME>`. The environment variable created converts input names to uppercase letters and replaces spaces with `_` characters.
 
-If the action is written using a [composite](/actions/tutorials/create-actions/create-a-composite-action), then it will not automatically get `INPUT_<VARIABLE_NAME>`. With composite actions you can use the [`inputs` context](/actions/reference/workflows-and-actions/contexts#inputs-context) to access action inputs.
+If the action is written using a [composite](/actions/tutorials/create-actions/create-a-composite-action), then it will not automatically get `INPUT_<VARIABLE_NAME>`. With composite actions you can use the [`inputs` context](/actions/reference/workflows-and-actions/contexts#inputs-context) to access action inputs. The `secrets` and `vars` contexts are not directly available inside composite actions; any secrets or configuration variables must be passed explicitly as inputs from the calling workflow.
 
 To access the environment variable in a Docker container action, you must pass the input using the `args` keyword in the action metadata file. For more information about the action metadata file for Docker container actions, see [AUTOTITLE](/actions/tutorials/use-containerized-services/create-a-docker-container-action#creating-an-action-metadata-file).
 

content/actions/tutorials/create-actions/create-a-composite-action.md

@@ -31,6 +31,9 @@ Once you complete this project, you should understand how to build your own comp
 
 Composite actions allow you to collect a series of workflow job steps into a single action which you can then run as a single job step in multiple workflows. Reusable workflows provide another way of avoiding duplication, by allowing you to run a complete workflow from within other workflows. For more information, see [AUTOTITLE](/actions/concepts/workflows-and-actions/reusing-workflow-configurations).
 
+> [!NOTE]
+> Composite actions do not have direct access to the `secrets` or `vars` contexts. If your composite action requires secrets or configuration variables, pass them explicitly using `inputs`. For more information, see [AUTOTITLE](/actions/reference/workflows-and-actions/contexts#secrets-context) and [AUTOTITLE](/actions/reference/workflows-and-actions/contexts#vars-context).
+
 ## Prerequisites
 >
 > [!NOTE]