Add credential validation step to catch missing secrets early with clear error message.
Use direct secret injection (not env vars) for better security.
Isolate docker config to /tmp/docker-config.
Reference: riotpiao.com action run 496/707
Unified structure:
- test job: all branches + PRs
- build-push job: main push only, depends on test
- Install Node.js before checkout
- Install docker only in build-push
- Proper secrets and env handling
- Docker login + build + push + prune