ci: run the unit tests; build pull requests, publish only release tags

As libreshop/cms adopted: a test job pipes the source into the image's base
(the Dockerfile's first FROM, node:22-slim) and runs npm test there without
network. The image build needs it and runs for pull requests (build only)
and v* tags (published if PUBLISH_ENABLED). main no longer publishes :main
and :sha-* images; mp pins the shop image by version tag.

Refs libretech/mp#71

.gitea/workflows/build.yml

@@ -8,7 +8,27 @@ on:
     branches: [main]
 
 jobs:
+  test:
+    runs-on: ubuntu-latest
+    container:
+      image: git.librete.ch/public/runner-image:v0.2.0@sha256:f60c587d3c0b0aac04a572db5349e27672bf76baec2ce547a3dcc28cebcf1b7e
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v4
+
+      # The tests need no dependencies. They run in the image's base (Dockerfile FROM), so on the runtime's Node,
+      # without network. The source is piped in because the job container's paths do not exist on the Docker host.
+      - name: npm test, on the Node of the image
+        run: |
+          base=$(sed -n 's/^FROM \([^ ]*\).*/\1/p' Dockerfile | head -1)
+          tar -c --exclude=.git . | docker run -i --rm --network none -e npm_config_update_notifier=false "$base" \
+            sh -c 'mkdir /w && cd /w && tar -x && npm test'
+
+  # The image is built to check a pull request, and built and published only for a release tag.
+  # Nothing pulls per-commit images, so main no longer publishes :main and :sha-* images.
   build:
+    needs: test
+    if: github.event_name == 'pull_request' || startsWith(github.ref, 'refs/tags/v')
     runs-on: ubuntu-latest
     container:
       image: git.librete.ch/public/runner-image:v0.2.0@sha256:f60c587d3c0b0aac04a572db5349e27672bf76baec2ce547a3dcc28cebcf1b7e
@@ -21,4 +41,4 @@ jobs:
           registry: ${{ secrets.REGISTRY }}
           registry_user: ${{ secrets.REGISTRY_USER }}
           registry_pass: ${{ secrets.REGISTRY_PASS }}
-          publish: ${{ github.event_name == 'push' && vars.PUBLISH_ENABLED == 'true' }}
+          publish: ${{ startsWith(github.ref, 'refs/tags/v') && vars.PUBLISH_ENABLED == 'true' }}

README.md

@@ -3,8 +3,8 @@
 Vue/Nuxt-style storefront base.
 
 Part of the [libreshop](https://git.librete.ch/libreshop) toolkit. Image
-published at `git.librete.ch/libreshop/shop` on every push to `main`
-and on `v*` tags.
+published at `git.librete.ch/libreshop/shop` on `v*` tags; pull requests
+build it without publishing.
 
 ## Source
 
@@ -18,6 +18,11 @@ pulls `git.librete.ch/libreshop/shop:<pin>` instead of building locally.
 docker build -t libreshop/shop:dev .
 ```
 
+## Test
+
+`npm test` runs the unit tests in `tests/unit/` on Node 22.6 or later, without
+installing dependencies.
+
 ## Adapter contract
 
 See `docker-entrypoint.sh` and `Dockerfile` for the runtime surface.