feat: add include_env input and environments output

[eliran-ops]

Summary

Adds the include_env + git_token inputs and the environments output to the action, so callers can read the local environments: block from skyhook.yaml in the same step that resolves service config.

• include_env=true + block present → emit (YAML, heredoc-safe; [] passes through)
• include_env=true + block missing (key absent, any YAML null spelling, bare key, or whole file missing) → exit 1 Not supported yet
• include_env=false or unset → emit empty (backwards compatible)
• git_token declared but unused — reserved placeholder for the future external-repository fetch path

Null detection uses yq … | tag == "!!null" so all four null spellings (null/Null/NULL/~) and bare environments: are caught uniformly.

Reviewer guide

Order to read:

1. action.yml — new inputs, new output, env wiring.
2. scripts/parse.sh — new emit_environments() helper + two new exit branches (config-missing-with-include_env, env-block-missing). Existing service-lookup paths unchanged.
3. tests/parse_test.sh — 24 new assertions: happy path, every null spelling, [] pass-through, regression guard for include_env=false, log-line guards, orthogonality between env emission and service lookup.
4. tests/fixtures-no-env/ — small fixture for the new CI smoke "Not supported yet" contract step.
5. .github/workflows/test.yml — two new smoke steps (happy + continue-on-error failure contract).
6. README.md — new inputs/outputs in the tables, env-passthrough usage example, expanded behavior matrix.

What's risky:

• The CI smoke "failure contract" step uses continue-on-error: true. If the action ever silently succeeded when it should have failed, the immediately-following outcome != "failure" assertion catches it.
• Heredoc-output for the environments value relies on the existing write_output helper (16-hex random delimiter, pre-existing pattern).

What's mechanical:

• README and action.yml description text — they were kept in sync after each iteration of review (any drift was flagged and corrected).
• 4 cycles of /review --deep + 1 cycle of /pre-pr (DEEP DEEP) ran on this branch before opening. Every actionable item was addressed and re-verified.

Test plan

• bash tests/metadata_test.sh — passes locally
• bash tests/parse_test.sh — 81 PASS, 0 FAIL
• shellcheck -S warning scripts/parse.sh tests/parse_test.sh tests/metadata_test.sh — clean
• yq e '.' action.yml and both fixture skyhook.yaml files — valid YAML
• CI smoke job (ubuntu-latest) — runs the composite action end-to-end against fixtures, including the two new include_env steps
• CI shell-tests matrix (ubuntu-latest + macos-latest) — runs the bash unit suite on both OSes

Depends on: #1 (feat: add required default_build_context / default_dockerfile_path inputs) — this PR targets ship-main so the diff is exactly the include_env work; rebase to main after #1 lands.

🤖 Generated with Claude Code

---

Note

Medium Risk
Adds a new output and new failure modes when include_env=true (including failing on missing config/environments), which can break workflows that opt into the flag. Core service parsing remains largely unchanged, lowering risk for existing users who keep defaults.

Overview
Adds optional include_env/git_token inputs and a new environments output so the action can return the top-level environments: block from the local skyhook.yaml (heredoc-safe, including pass-through of environments: []).

Updates scripts/parse.sh to emit environments when enabled and to fail fast with Not supported yet when include_env=true but the config file is missing or environments is absent/null (detected via yq tag to cover all YAML null spellings).

Expands CI and docs: new smoke steps and fixtures for the happy-path and expected-failure contract, plus extensive unit tests covering the new flag behavior and regressions when include_env=false.

^{Reviewed by Cursor Bugbot for commit 0110e19. Bugbot is set up for automated code reviews on this repo. Configure here.}