[GitHubActions] generator: arbitrary extra `with:` inputs on the checkout step

[avidenic]

Description

Fallout's GitHubActionsCheckoutStep (src/Fallout.Common/CI/GitHubActions/Configuration/GitHubActionsCheckoutStep.cs) already emits a solid subset of actions/checkout inputs: submodules, lfs, fetch-depth, progress, filter, plus the fork-aware ref/repository (CheckoutRef). This is genuinely good and we don't want to lose it; the gap is narrow.

GitHubActionsCheckoutStep.Write only emits those known keys. There is no escape hatch for the many other actions/checkout inputs: token:, ssh-key:, path:, clean:, persist-credentials:, sparse-checkout:, set-safe-directory:. If you need any of them, the generator simply can't produce the workflow.

Proposed change: add a string[] CheckoutWith property (raw key: value lines appended verbatim inside the existing with: block, after the typed keys), surfaced setter-only on GitHubActionsAttribute alongside CheckoutRef. Backward compatible (defaults to empty, emits nothing).

Optional, same area: the action version is hardcoded actions/checkout@v6. A CheckoutAction/Version property would close pinning requests too, though not the headline ask.

Note: running shell steps right after checkout is deliberately out of scope here; it belongs to a general step-injection mechanism rather than a second injection path bolted onto the checkout step.

Usage Example

[GitHubActions(
    "build",
    GitHubActionsImage.UbuntuLatest,
    On = [GitHubActionsTrigger.Push],
    InvokedTargets = [nameof(Compile)],
    Submodules = GitHubActionsSubmodules.Recursive, // existing
    FetchDepth = 0,                                  // existing
    Filter = "blob:none",                            // existing
    CheckoutWith =                                   // NEW: escape hatch
    [
        "token: ${{ secrets.CI_PAT }}",
        "path: src",
        "persist-credentials: false",
    ])]
public partial class Build : NukeBuild { /* ... */ }

Resulting YAML:

steps:
  - uses: actions/checkout@v6
    with:
      submodules: recursive
      fetch-depth: 0
      filter: blob:none
      token: ${{ secrets.CI_PAT }}
      path: src
      persist-credentials: false

Alternative

Hand-edit the generated YAML (breaks generate-and-check-in) or drop the generator for those workflows.

Could you help with a pull-request?

Yes.