Every push to main published :main and :sha-* images, which nothing pulls. The libreshop images had grown to 5.8 GB in the registry, on a Gitea host that is nearly out of space. - test: npm test for every pull request, every push to main and every release tag. It runs in the image's base (Dockerfile FROM, node:22.14.0-alpine), so on the runtime's Node, without network and without dependencies. The source is piped into the container, because the job container's paths do not exist on the Docker host. - build: after the tests, for a pull request (build only) and for a v* tag (build and, with PUBLISH_ENABLED, publish :vX.Y.Z and :latest). Refs libretech/mp#71