feat(ci): add mix test step with postgres before build-and-push

Adds a postgres:17-alpine service, a wait-for-postgres step, and a
Run tests step that runs mix ecto.create/migrate/test in the same
docker-run pattern. If tests fail, the Build and push step is
automatically skipped.

.forgejo/workflows/build.yaml

@@ -21,6 +21,15 @@ jobs:
     name: Build and Push Docker Image
     runs-on: ubuntu-latest
 
+    services:
+      postgres:
+        image: postgres:17-alpine
+        env:
+          POSTGRES_USER: postgres
+          POSTGRES_PASSWORD: postgres
+        ports:
+          - 5432:5432
+
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
@@ -68,6 +77,42 @@ jobs:
               mix assets.setup && \
               mix compile --warnings-as-errors'
 
+      - name: Wait for PostgreSQL
+        run: |
+          set -euo pipefail
+          for i in $(seq 1 30); do
+            if echo >/dev/tcp/localhost/5432 2>/dev/null; then
+              echo "PostgreSQL ready"
+              exit 0
+            fi
+            echo "Waiting for PostgreSQL ($i/30)..."
+            sleep 2
+          done
+          echo "PostgreSQL did not become ready" >&2
+          exit 1
+
+      - name: Run tests
+        run: |
+          set -euo pipefail
+          tar --exclude='_build' --exclude='deps' --exclude='.git' \
+              --exclude='priv/static/assets' --exclude='assets/node_modules' \
+              --exclude='rust' --exclude='target' \
+              -cf - . | \
+          docker run --rm -i \
+            -e MIX_ENV=test \
+            --network host \
+            -w /app \
+            docker.io/hexpm/elixir:1.20.1-erlang-29.0.2-debian-trixie-20260518-slim \
+            sh -euc '\
+              mkdir -p /app && cd /app && tar xf - && \
+              apt-get update -qq && apt-get install -y -qq git curl ca-certificates build-essential && \
+              mix local.hex --force && \
+              mix local.rebar --force && \
+              mix deps.get && \
+              mix ecto.create --quiet && \
+              mix ecto.migrate --quiet && \
+              mix test'
+
       - name: Build and push
         env:
           REGISTRY_TOKEN: ${{ secrets.FORGEJO_TOKEN }}