As libreshop/cms adopted: a test job pipes the source into the image's base (the Dockerfile's first FROM, node:22-slim) and runs npm test there without network. The image build needs it and runs for pull requests (build only) and v* tags (published if PUBLISH_ENABLED). main no longer publishes :main and :sha-* images; mp pins the shop image by version tag. Refs libretech/mp#71