ci: run the unit tests, and build images only for pull requests and releases

Every push to main published :main and :sha-* images, which nothing pulls.
The libreshop images had grown to 5.8 GB in the registry, on a Gitea host that
is nearly out of space.

- test: npm test on Node 22.14.0, the Node of the image, for every pull
  request, every push to main and every release tag.
- build: after the tests, for a pull request (build only) and for a v* tag
  (build and, with PUBLISH_ENABLED, publish :vX.Y.Z and :latest).

Refs libretech/mp#71

.gitea/workflows/build.yml

@@ -8,7 +8,28 @@ on:
     branches: [main]
 
 jobs:
+  test:
+    runs-on: ubuntu-latest
+    container:
+      image: git.librete.ch/public/runner-image:v0.2.0@sha256:f60c587d3c0b0aac04a572db5349e27672bf76baec2ce547a3dcc28cebcf1b7e
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v4
+
+      # The Node version of the image (Dockerfile FROM), so the tests run on the runtime's Node.
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "22.14.0"
+
+      - run: npm test
+        env:
+          npm_config_update_notifier: "false"
+
+  # The image is built to check a pull request, and built and published only for a release tag.
+  # Nothing pulls per-commit images, so main no longer publishes :main and :sha-* images.
   build:
+    needs: test
+    if: github.event_name == 'pull_request' || startsWith(github.ref, 'refs/tags/v')
     runs-on: ubuntu-latest
     container:
       image: git.librete.ch/public/runner-image:v0.2.0@sha256:f60c587d3c0b0aac04a572db5349e27672bf76baec2ce547a3dcc28cebcf1b7e
@@ -21,4 +42,4 @@ jobs:
           registry: ${{ secrets.REGISTRY }}
           registry_user: ${{ secrets.REGISTRY_USER }}
           registry_pass: ${{ secrets.REGISTRY_PASS }}
-          publish: ${{ github.event_name == 'push' && vars.PUBLISH_ENABLED == 'true' }}
+          publish: ${{ startsWith(github.ref, 'refs/tags/v') && vars.PUBLISH_ENABLED == 'true' }}