Test the checkout code; publish images only for releases (#5)

- src/checkout/ (PayPal order request, pricing, VAT) and src/logging/format.ts
  hold the checkout's pure code, moved out of PayPalApi, the product service
  and config without a behaviour change.
- npm test runs node:test on the TypeScript sources (type stripping), with no
  dependencies: 21 tests, 13 pin today's output, 8 describe the correct
  behaviour for the known defects of libretech/mp#67
  and are marked todo.
- CI: the tests run in the image's base (node:22.14.0-alpine) for every pull
  request, push to main and release tag. The image is built for pull requests
  and built and published only for v* tags; main no longer publishes :main
  and :sha-* images.

Refs libretech/mp#71

Co-authored-by: Michael Czechowski <mail@librete.ch>

.gitea/workflows/build.yml

@@ -16,14 +16,13 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      # The Node version of the image (Dockerfile FROM), so the tests run on the runtime's Node.
+      # The tests need no dependencies. They run in the image's base (Dockerfile FROM), so on the runtime's Node,
-      - uses: actions/setup-node@v4
+      # without network. The source is piped in because the job container's paths do not exist on the Docker host.
-        with:
+      - name: npm test, on the Node of the image
-          node-version: "22.14.0"
+        run: |
-
+          base=$(sed -n 's/^FROM \([^ ]*\).*/\1/p' Dockerfile | head -1)
-      - run: npm test
+          tar -c --exclude=.git . | docker run -i --rm --network none -e npm_config_update_notifier=false "$base" \
-        env:
+            sh -c 'mkdir /w && cd /w && tar -x && npm test'
-          npm_config_update_notifier: "false"
 
   # The image is built to check a pull request, and built and published only for a release tag.
   # Nothing pulls per-commit images, so main no longer publishes :main and :sha-* images.