CI: fail on test failures and skip image push on pull requests

.github/workflows/ci-cd.yml

@@ -26,7 +26,7 @@ jobs:
         run: npm ci
 
       - name: Run tests
-        run: npm test || echo "No tests found, would add tests in a real project"
+        run: npm test
 
   lint:
     name: Static Code Analysis
@@ -96,6 +96,7 @@ jobs:
         uses: docker/setup-buildx-action@v3
 
       - name: Login to GitHub Container Registry
+        if: github.event_name == 'push'
         uses: docker/login-action@v3
         with:
           registry: ${{ env.REGISTRY }}
@@ -132,6 +133,7 @@ jobs:
           severity: 'CRITICAL,HIGH'
 
       - name: Push Docker image
+        if: github.event_name == 'push'
         uses: docker/build-push-action@v5
         with:
           context: .

Dockerfile

@@ -8,6 +8,8 @@ RUN npm run build
 
 # Production stage
 FROM nginx:alpine
+# Pull in security fixes newer than the base image (Trivy fails the build on HIGH/CRITICAL)
+RUN apk upgrade --no-cache
 COPY --from=build /app/dist /usr/share/nginx/html
 # Add nginx configuration if needed
 # COPY nginx.conf /etc/nginx/conf.d/default.conf