Adds a public Env property to GitHubActionsAttribute

[avidenic]

Closes #385.

What

Adds a public Env property to GitHubActionsAttribute (entries in KEY: value form), emitted once as a top-level env: block in the generated workflow — after on: and before permissions: — and inherited by every job and step, including non-run steps (checkout, cache, artifact upload) that per-step env can't reach.

[GitHubActions(
    "ci",
    GitHubActionsImage.UbuntuLatest,
    On = [GitHubActionsTrigger.Push, GitHubActionsTrigger.PullRequest],
    InvokedTargets = [nameof(Test)],
    Env =
    [
        "DOTNET_CLI_TELEMETRY_OPTOUT: 1",
        "DOTNET_NOLOGO: true",
        "NUGET_XMLDOC_MODE: skip",
        "Configuration: Release",
    ])]
public partial class Build : NukeBuild { /* ... */ }

name: ci

on: [push, pull_request]

env:
  DOTNET_CLI_TELEMETRY_OPTOUT: 1
  DOTNET_NOLOGO: true
  NUGET_XMLDOC_MODE: skip
  Configuration: Release

jobs:
  ...

How

1. GitHubActionsAttribute.Env (string[], defaults to empty) → carried through GetConfiguration into a matching GitHubActionsConfiguration.Env.
2. GitHubActionsConfiguration.Write emits the block only when non-empty, one indented entry per line, positioned after on: and before permissions:/concurrency:/jobs:.
3. Entries are validated at configuration-generation time (the issue asked for a minimal colon check; this goes a little stricter to keep generated YAML well-formed): each entry must be non-null, have a non-empty whitespace-free key, and a space after the colon. A malformed entry fails the build with a clear message instead of silently emitting broken YAML. A trailing colon with no value (KEY:) is allowed (valid empty value); colons inside the value are fine (first colon is the separator).

Job- and step-level env are intentionally out of scope, as noted in the issue — they only become meaningful once multi-job/matrix workflows exist.

Backwards compatibility

Purely additive. Env defaults to empty, so existing [GitHubActions(...)] usages generate byte-for-byte identical YAML (no env: block). Non-breaking → target/2026, no breaking-change.

Testing

• Two Verify snapshots in ConfigurationGenerationTest: env-block (env → jobs) and env-block-with-permissions (locks on: → env: → permissions: → concurrency: → jobs: ordering and spacing).
• GitHubActionsEnvValidationTest: validation matrix (null, empty, whitespace-only, no-colon, empty-key, whitespace-in-key, no-space-after-colon, multi-entry-with-bad-element; plus well-formed positives including a value containing a colon and an empty-value entry).
• Full solution dotnet fallout Test Pack is green locally, including the Nuke.* transition-shim test projects that consume this public API.

Merge preference: (x) squash (default) ( ) rebase

[avidenic]

@ChrisonSimtian just a suggestion - this seems to be blocked every time a PR gets closed before this one even though there are no conflicting changes. Relaxing the rule that needs PR's branch always up to date might make things a bit smoother =)

[ChrisonSimtian]

@ChrisonSimtian just a suggestion - this seems to be blocked every time a PR gets closed before this one even though there are no conflicting changes. Relaxing the rule that needs PR's branch always up to date might make things a bit smoother =)

this goes away once your first contribution was merged :-) I've set this up intentional so that only contributors can run actions