Reference: riotpiao.com action run 496/707 Unified structure: - test job: all branches + PRs - build-push job: main push only, depends on test - Install Node.js before checkout - Install docker only in build-push - Proper secrets and env handling - Docker login + build + push + prune