ci: gate pull requests and enforce coverage thresholds

Add a pull_request trigger so branches are checked before merge, run
vitest with --coverage in CI so the configured 90/80/89/90 gates fail
the job on regression, and require the push event (plus Docker Hub
secrets) before QEMU/buildx/publish steps run so PR builds never push
images.

Author: Programcode

.github/workflows/deploy.yml

@@ -3,13 +3,14 @@ name: Build and Push Docker Image
 on:
   push:
     branches: [ "main" ]
+  pull_request:
   workflow_dispatch:
 
 jobs:
   build:
     runs-on: ubuntu-latest
     env:
-      DOCKER_PUSH: ${{ secrets.DOCKER_USERNAME != '' && secrets.DOCKER_PASSWORD != '' }}
+      DOCKER_PUSH: ${{ github.event_name == 'push' && secrets.DOCKER_USERNAME != '' && secrets.DOCKER_PASSWORD != '' }}
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
@@ -29,15 +30,17 @@ jobs:
         run: npm run typecheck
 
       - name: Test
-        run: npm test
+        run: npm test -- --coverage
 
       - name: Build
         run: npm run build
 
       - name: Set up QEMU
+        if: env.DOCKER_PUSH == 'true'
         uses: docker/setup-qemu-action@v3
 
       - name: Set up Docker Buildx
+        if: env.DOCKER_PUSH == 'true'
         uses: docker/setup-buildx-action@v3
 
       - name: Login to Docker Hub
@@ -49,6 +52,7 @@ jobs:
 
       # Create a minimal Dockerfile for multi-arch that just uses pre-built assets
       - name: Create production Dockerfile
+        if: env.DOCKER_PUSH == 'true'
         run: |
           cat > Dockerfile.prod << 'EOF'
           FROM nginx:alpine