From 53186e9a3597ead5dda4f3f53de5954f31e66033 Mon Sep 17 00:00:00 2001
From: Haylan <code@arthurerlich.ch>
Date: Fri, 17 Jul 2026 12:07:31 +0200
Subject: [PATCH 01/12] feat(ci): add GitHub Actions workflow for testing and
 Docker builds

---
 .gitea/workflows/test.yml | 62 +++++++++++++++++++++++++++++++++++++++
 1 file changed, 62 insertions(+)
 create mode 100644 .gitea/workflows/test.yml

diff --git a/.gitea/workflows/test.yml b/.gitea/workflows/test.yml
new file mode 100644
index 0000000..37654e4
--- /dev/null
+++ b/.gitea/workflows/test.yml
@@ -0,0 +1,62 @@
+name: Tests
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        
+      - name: Set up PHP
+        uses: shivammathur/setup-php@v2
+        with:
+          php-version: "8.4"
+          extensions: intl, zip, opcache
+          coverage: none
+
+      - name: Cache Composer dependencies
+        uses: actions/cache@v4
+        with:
+          path: ~/.composer/cache
+          key: composer-${{ hashFiles('composer.lock') }}
+          restore-keys: composer-
+
+      - name: Install dependencies
+        run: composer install --no-interaction --prefer-dist
+
+      - name: Run PHPUnit
+        run: vendor/bin/phpunit --testdox
+
+      - name: Run PHPStan
+        run: composer phpstan
+
+  docker-build:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Build prod image (final target)
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          file: Dockerfile
+          target: final
+          push: false
+
+      - name: Build dev image (dev target)
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          file: Dockerfile.dev
+          target: dev
+          push: false
-- 
2.54.0


From 14b325b3bf9d5ca8fe4466cb3bc3745cc9206bd8 Mon Sep 17 00:00:00 2001
From: Haylan <code@arthurerlich.ch>
Date: Fri, 17 Jul 2026 12:18:24 +0200
Subject: [PATCH 02/12] refactor(ci): migrate PHP setup to Docker for testing
 workflow

---
 .gitea/workflows/test.yml | 31 ++++++++++++++-----------------
 1 file changed, 14 insertions(+), 17 deletions(-)

diff --git a/.gitea/workflows/test.yml b/.gitea/workflows/test.yml
index 37654e4..0454909 100644
--- a/.gitea/workflows/test.yml
+++ b/.gitea/workflows/test.yml
@@ -12,29 +12,26 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v4
-        
-      - name: Set up PHP
-        uses: shivammathur/setup-php@v2
-        with:
-          php-version: "8.4"
-          extensions: intl, zip, opcache
-          coverage: none
 
-      - name: Cache Composer dependencies
-        uses: actions/cache@v4
-        with:
-          path: ~/.composer/cache
-          key: composer-${{ hashFiles('composer.lock') }}
-          restore-keys: composer-
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
 
-      - name: Install dependencies
-        run: composer install --no-interaction --prefer-dist
+      - name: Build dev image (PHP 8.4 + composer deps)
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          file: Dockerfile.dev
+          target: dev
+          load: true
+          tags: graph-dev:ci
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
 
       - name: Run PHPUnit
-        run: vendor/bin/phpunit --testdox
+        run: docker run --rm graph-dev:ci vendor/bin/phpunit --testdox
 
       - name: Run PHPStan
-        run: composer phpstan
+        run: docker run --rm graph-dev:ci composer phpstan
 
   docker-build:
     runs-on: ubuntu-latest
-- 
2.54.0


From 211edc4538b67cafb8850778bcbb498c3ba38b36 Mon Sep 17 00:00:00 2001
From: Haylan <code@arthurerlich.ch>
Date: Fri, 17 Jul 2026 12:27:41 +0200
Subject: [PATCH 03/12] refactor(ci): reorganize test workflow to streamline
 Docker image handling

---
 .gitea/workflows/test.yml | 45 ++++++++++++++++++++++++++-------------
 1 file changed, 30 insertions(+), 15 deletions(-)

diff --git a/.gitea/workflows/test.yml b/.gitea/workflows/test.yml
index 0454909..c848f86 100644
--- a/.gitea/workflows/test.yml
+++ b/.gitea/workflows/test.yml
@@ -7,7 +7,7 @@ on:
     branches: [main]
 
 jobs:
-  test:
+  build-dev:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
@@ -22,18 +22,19 @@ jobs:
           context: .
           file: Dockerfile.dev
           target: dev
-          load: true
+          outputs: type=docker,dest=/tmp/graph-dev.tar
           tags: graph-dev:ci
           cache-from: type=gha
           cache-to: type=gha,mode=max
 
-      - name: Run PHPUnit
-        run: docker run --rm graph-dev:ci vendor/bin/phpunit --testdox
-
-      - name: Run PHPStan
-        run: docker run --rm graph-dev:ci composer phpstan
-
-  docker-build:
+      - name: Upload dev image
+        uses: actions/upload-artifact@v4
+        with:
+          name: graph-dev-image
+          path: /tmp/graph-dev.tar
+          retention-days: 1
+  build-prod:
+    needs: build-dev
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
@@ -50,10 +51,24 @@ jobs:
           target: final
           push: false
 
-      - name: Build dev image (dev target)
-        uses: docker/build-push-action@v5
+  test:
+    needs: build-dev
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Download dev image
+        uses: actions/download-artifact@v4
         with:
-          context: .
-          file: Dockerfile.dev
-          target: dev
-          push: false
+          name: graph-dev-image
+          path: /tmp
+
+      - name: Load dev image
+        run: docker load --input /tmp/graph-dev.tar
+
+      - name: Run PHPUnit
+        run: docker run --rm graph-dev:ci vendor/bin/phpunit --testdox
+
+      - name: Run PHPStan
+        run: docker run --rm graph-dev:ci composer phpstan
-- 
2.54.0


From d6a4f7c41fe27ddce256e830fcba8aecec101ce7 Mon Sep 17 00:00:00 2001
From: Haylan <code@arthurerlich.ch>
Date: Fri, 17 Jul 2026 12:37:12 +0200
Subject: [PATCH 04/12] feat(ci): update Gitea workflow to include registry
 login and cache handling adjustments

---
 .gitea/workflows/test.yml | 17 +++++++++++++++--
 CLAUDE.md                 | 17 +++++++++++++++++
 2 files changed, 32 insertions(+), 2 deletions(-)

diff --git a/.gitea/workflows/test.yml b/.gitea/workflows/test.yml
index c848f86..97e0e53 100644
--- a/.gitea/workflows/test.yml
+++ b/.gitea/workflows/test.yml
@@ -6,6 +6,9 @@ on:
   pull_request:
     branches: [main]
 
+env:
+  REGISTRY: git.arthurerlich.de
+
 jobs:
   build-dev:
     runs-on: ubuntu-latest
@@ -16,6 +19,16 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
 
+      # type=gha depends on act_runner's internal cache proxy, which is unreachable
+      # from job containers on this runner (dial tcp ... i/o timeout). Use the
+      # registry cache backend instead, same as docker-publish.yml.
+      - name: Log in to Gitea registry
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ gitea.actor }}
+          password: ${{ secrets.REGISTRY_TOKEN }}
+
       - name: Build dev image (PHP 8.4 + composer deps)
         uses: docker/build-push-action@v5
         with:
@@ -24,8 +37,8 @@ jobs:
           target: dev
           outputs: type=docker,dest=/tmp/graph-dev.tar
           tags: graph-dev:ci
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
+          cache-from: type=registry,ref=${{ env.REGISTRY }}/${{ gitea.repository }}:buildcache-dev
+          cache-to: type=registry,ref=${{ env.REGISTRY }}/${{ gitea.repository }}:buildcache-dev,mode=max
 
       - name: Upload dev image
         uses: actions/upload-artifact@v4
diff --git a/CLAUDE.md b/CLAUDE.md
index d9384df..49dd6e4 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -138,12 +138,29 @@ Workflow files live in [.gitea/workflows/](.gitea/workflows/). This project uses
 - Secrets are set under Repository → Settings → Secrets → Actions
 - The registry hostname must be derived from `gitea.server_url` (strip the protocol prefix)
 - Triggers use standard `on:` syntax; `tags: '*.*.*'` matches semver pushes without a `v` prefix
+- Do not use `cache-from/cache-to: type=gha` — on this instance's act_runner (v2.0.0), the internal GitHub Actions-cache-compatible proxy is not reachable from job containers (`dial tcp <ip>:<port>: i/o timeout`), a known act_runner docker-executor networking limitation, not a workflow bug. Use `type=registry` instead (push cache blobs to `${{ env.REGISTRY }}/<repo>:buildcache*` — see both `test.yml` and `docker-publish.yml`); it requires a registry login step even for jobs that don't push the final image.
 
 **Current workflows:**
 
 | File                 | Trigger          | Purpose                                                   |
 | -------------------- | ---------------- | --------------------------------------------------------- |
 | `docker-publish.yml` | Push tag `*.*.*` | Build & push multi-arch image to Gitea container registry |
+| `test.yml`           | Push/PR to `main`| Build dev+prod images, run PHPUnit and PHPStan            |
+
+### Release testing with `act`
+
+Before tagging a release (anything that would trigger `docker-publish.yml`), run `test.yml` locally with [`act`](https://github.com/nektos/act) to catch pipeline failures before pushing. `test.yml` uses plain GitHub Actions syntax (no `gitea.*` contexts), so it runs under `act` unmodified.
+
+```bash
+act -j test \
+  -P ubuntu-latest=catthehacker/ubuntu:act-latest \
+  --artifact-server-path /tmp/act-artifacts
+```
+
+- `-P ubuntu-latest=catthehacker/ubuntu:act-latest` — default act runner image lacks a Docker CLI, which the `test` job needs for its nested `docker run` steps
+- `--artifact-server-path` — required for the `upload-artifact`/`download-artifact` steps to work; without it they silently no-op
+
+**If `act` is not installed:** warn the user it's missing and how to install it (`sudo pacman -S act`, or see the repo above) — do not install it yourself or force the check. `docker-publish.yml` is out of scope for `act` (it needs real `gitea.*` context and a live registry secret); don't try to run it locally.
 
 ## Docker
 
-- 
2.54.0


From f3491ef4a65b62a2f1cde87465662fc5699b27dc Mon Sep 17 00:00:00 2001
From: Haylan <code@arthurerlich.ch>
Date: Fri, 17 Jul 2026 12:41:35 +0200
Subject: [PATCH 05/12] fix(ci): downgrade actions/upload-artifact and
 actions/download-artifact to v3 for compatibility

---
 .gitea/workflows/test.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.gitea/workflows/test.yml b/.gitea/workflows/test.yml
index 97e0e53..39ae604 100644
--- a/.gitea/workflows/test.yml
+++ b/.gitea/workflows/test.yml
@@ -41,7 +41,7 @@ jobs:
           cache-to: type=registry,ref=${{ env.REGISTRY }}/${{ gitea.repository }}:buildcache-dev,mode=max
 
       - name: Upload dev image
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v3
         with:
           name: graph-dev-image
           path: /tmp/graph-dev.tar
@@ -72,7 +72,7 @@ jobs:
         uses: actions/checkout@v4
 
       - name: Download dev image
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v3
         with:
           name: graph-dev-image
           path: /tmp
-- 
2.54.0


From 0b1fed2f93d58b209617eb40b86259936603dc4a Mon Sep 17 00:00:00 2001
From: Haylan <code@arthurerlich.ch>
Date: Thu, 30 Jul 2026 07:04:53 +0200
Subject: [PATCH 06/12] fix(ci): add volume mounts for PHPUnit and PHPStan runs
 in test workflow

---
 .gitea/workflows/test.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.gitea/workflows/test.yml b/.gitea/workflows/test.yml
index 39ae604..2af46a9 100644
--- a/.gitea/workflows/test.yml
+++ b/.gitea/workflows/test.yml
@@ -81,7 +81,7 @@ jobs:
         run: docker load --input /tmp/graph-dev.tar
 
       - name: Run PHPUnit
-        run: docker run --rm graph-dev:ci vendor/bin/phpunit --testdox
+        run: docker run --rm -v "$(pwd)":/app -v /app/vendor graph-dev:ci vendor/bin/phpunit --testdox
 
       - name: Run PHPStan
-        run: docker run --rm graph-dev:ci composer phpstan
+        run: docker run --rm -v "$(pwd)":/app -v /app/vendor graph-dev:ci composer phpstan
-- 
2.54.0


From 47d9a62db725def5d9e5a68e13e597f584660ca7 Mon Sep 17 00:00:00 2001
From: Haylan <code@arthurerlich.ch>
Date: Fri, 31 Jul 2026 08:36:29 +0200
Subject: [PATCH 07/12] refactor(ci): streamline test workflow by consolidating
 test commands and removing unnecessary comments

---
 .gitea/workflows/test.yml | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/.gitea/workflows/test.yml b/.gitea/workflows/test.yml
index 2af46a9..5e06141 100644
--- a/.gitea/workflows/test.yml
+++ b/.gitea/workflows/test.yml
@@ -19,9 +19,6 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
 
-      # type=gha depends on act_runner's internal cache proxy, which is unreachable
-      # from job containers on this runner (dial tcp ... i/o timeout). Use the
-      # registry cache backend instead, same as docker-publish.yml.
       - name: Log in to Gitea registry
         uses: docker/login-action@v3
         with:
@@ -46,6 +43,7 @@ jobs:
           name: graph-dev-image
           path: /tmp/graph-dev.tar
           retention-days: 1
+
   build-prod:
     needs: build-dev
     runs-on: ubuntu-latest
@@ -77,11 +75,13 @@ jobs:
           name: graph-dev-image
           path: /tmp
 
-      - name: Load dev image
+  - name: Load dev image
         run: docker load --input /tmp/graph-dev.tar
 
-      - name: Run PHPUnit
-        run: docker run --rm -v "$(pwd)":/app -v /app/vendor graph-dev:ci vendor/bin/phpunit --testdox
-
-      - name: Run PHPStan
-        run: docker run --rm -v "$(pwd)":/app -v /app/vendor graph-dev:ci composer phpstan
+      - name: Run tests in dev image
+        run: |
+          docker run --rm -v "$(pwd)":/app -v /app/vendor graph-dev:ci sh -c "
+            composer install --no-interaction &&
+            vendor/bin/phpunit --testdox &&
+            composer phpstan
+          "
-- 
2.54.0


From 222c8aaa85e4c2f51dc7499296162a8d079b73ea Mon Sep 17 00:00:00 2001
From: Haylan <code@arthurerlich.ch>
Date: Fri, 31 Jul 2026 10:54:50 +0200
Subject: [PATCH 08/12] fix(ci): correct indentation for loading dev image in
 test workflow

---
 .gitea/workflows/test.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.gitea/workflows/test.yml b/.gitea/workflows/test.yml
index 5e06141..cca8591 100644
--- a/.gitea/workflows/test.yml
+++ b/.gitea/workflows/test.yml
@@ -75,7 +75,7 @@ jobs:
           name: graph-dev-image
           path: /tmp
 
-  - name: Load dev image
+      - name: Load dev image
         run: docker load --input /tmp/graph-dev.tar
 
       - name: Run tests in dev image
-- 
2.54.0


From 30a243991483fe4edce8c694f3504e3a67109b97 Mon Sep 17 00:00:00 2001
From: Haylan <code@arthurerlich.ch>
Date: Fri, 31 Jul 2026 13:46:34 +0200
Subject: [PATCH 09/12] feat(ci): enhance debugging in test workflow with
 workspace information

---
 .gitea/workflows/test.yml | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/.gitea/workflows/test.yml b/.gitea/workflows/test.yml
index cca8591..375e87c 100644
--- a/.gitea/workflows/test.yml
+++ b/.gitea/workflows/test.yml
@@ -78,9 +78,17 @@ jobs:
       - name: Load dev image
         run: docker load --input /tmp/graph-dev.tar
 
+      - name: Debug workspace
+        run: |
+          echo "pwd: $(pwd)"
+          echo "GITHUB_WORKSPACE: $GITHUB_WORKSPACE"
+          ls -la
+
       - name: Run tests in dev image
         run: |
           docker run --rm -v "$(pwd)":/app -v /app/vendor graph-dev:ci sh -c "
+            echo '--- /app contents ---' &&
+            ls -la /app &&
             composer install --no-interaction &&
             vendor/bin/phpunit --testdox &&
             composer phpstan
-- 
2.54.0


From 06fc829ff1b7f983bbae2a33de06f6edf2ba8483 Mon Sep 17 00:00:00 2001
From: Haylan <code@arthurerlich.ch>
Date: Fri, 31 Jul 2026 14:02:51 +0200
Subject: [PATCH 10/12] fix(ci): update dev image build process and simplify
 test execution

---
 .gitea/workflows/test.yml | 46 +++++++++++----------------------------
 1 file changed, 13 insertions(+), 33 deletions(-)

diff --git a/.gitea/workflows/test.yml b/.gitea/workflows/test.yml
index 375e87c..95dc3cf 100644
--- a/.gitea/workflows/test.yml
+++ b/.gitea/workflows/test.yml
@@ -8,6 +8,7 @@ on:
 
 env:
   REGISTRY: git.arthurerlich.de
+  DEV_IMAGE: git.arthurerlich.de/${{ gitea.repository }}:ci-${{ gitea.sha }}
 
 jobs:
   build-dev:
@@ -26,24 +27,17 @@ jobs:
           username: ${{ gitea.actor }}
           password: ${{ secrets.REGISTRY_TOKEN }}
 
-      - name: Build dev image (PHP 8.4 + composer deps)
+      - name: Build and push dev image (PHP 8.4 + composer deps)
         uses: docker/build-push-action@v5
         with:
           context: .
           file: Dockerfile.dev
           target: dev
-          outputs: type=docker,dest=/tmp/graph-dev.tar
-          tags: graph-dev:ci
+          push: true
+          tags: ${{ env.DEV_IMAGE }}
           cache-from: type=registry,ref=${{ env.REGISTRY }}/${{ gitea.repository }}:buildcache-dev
           cache-to: type=registry,ref=${{ env.REGISTRY }}/${{ gitea.repository }}:buildcache-dev,mode=max
 
-      - name: Upload dev image
-        uses: actions/upload-artifact@v3
-        with:
-          name: graph-dev-image
-          path: /tmp/graph-dev.tar
-          retention-days: 1
-
   build-prod:
     needs: build-dev
     runs-on: ubuntu-latest
@@ -65,31 +59,17 @@ jobs:
   test:
     needs: build-dev
     runs-on: ubuntu-latest
+    container:
+      image: ${{ env.DEV_IMAGE }}
+      credentials:
+        username: ${{ gitea.actor }}
+        password: ${{ secrets.REGISTRY_TOKEN }}
     steps:
       - name: Checkout
         uses: actions/checkout@v4
 
-      - name: Download dev image
-        uses: actions/download-artifact@v3
-        with:
-          name: graph-dev-image
-          path: /tmp
-
-      - name: Load dev image
-        run: docker load --input /tmp/graph-dev.tar
-
-      - name: Debug workspace
+      - name: Run tests
         run: |
-          echo "pwd: $(pwd)"
-          echo "GITHUB_WORKSPACE: $GITHUB_WORKSPACE"
-          ls -la
-
-      - name: Run tests in dev image
-        run: |
-          docker run --rm -v "$(pwd)":/app -v /app/vendor graph-dev:ci sh -c "
-            echo '--- /app contents ---' &&
-            ls -la /app &&
-            composer install --no-interaction &&
-            vendor/bin/phpunit --testdox &&
-            composer phpstan
-          "
+          composer install --no-interaction
+          vendor/bin/phpunit --testdox
+          composer phpstan
-- 
2.54.0


From 658892a639b6b9fe8cf50ad130041529f103fab8 Mon Sep 17 00:00:00 2001
From: Haylan <code@arthurerlich.ch>
Date: Fri, 31 Jul 2026 14:07:07 +0200
Subject: [PATCH 11/12] fix(ci): remove redundant DEV_IMAGE variable and use
 REGISTRY directly for image tags

---
 .gitea/workflows/test.yml | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/.gitea/workflows/test.yml b/.gitea/workflows/test.yml
index 95dc3cf..50b596c 100644
--- a/.gitea/workflows/test.yml
+++ b/.gitea/workflows/test.yml
@@ -8,7 +8,6 @@ on:
 
 env:
   REGISTRY: git.arthurerlich.de
-  DEV_IMAGE: git.arthurerlich.de/${{ gitea.repository }}:ci-${{ gitea.sha }}
 
 jobs:
   build-dev:
@@ -34,7 +33,7 @@ jobs:
           file: Dockerfile.dev
           target: dev
           push: true
-          tags: ${{ env.DEV_IMAGE }}
+          tags: ${{ env.REGISTRY }}/${{ gitea.repository }}:ci-${{ gitea.sha }}
           cache-from: type=registry,ref=${{ env.REGISTRY }}/${{ gitea.repository }}:buildcache-dev
           cache-to: type=registry,ref=${{ env.REGISTRY }}/${{ gitea.repository }}:buildcache-dev,mode=max
 
@@ -60,7 +59,7 @@ jobs:
     needs: build-dev
     runs-on: ubuntu-latest
     container:
-      image: ${{ env.DEV_IMAGE }}
+      image: ${{ env.REGISTRY }}/${{ gitea.repository }}:ci-${{ gitea.sha }}
       credentials:
         username: ${{ gitea.actor }}
         password: ${{ secrets.REGISTRY_TOKEN }}
-- 
2.54.0


From a8f5680e6ee0edb3afc6bbc006b155145db02453 Mon Sep 17 00:00:00 2001
From: Haylan <code@arthurerlich.ch>
Date: Fri, 31 Jul 2026 14:17:39 +0200
Subject: [PATCH 12/12] fix(ci): update dev image build process and run tests
 in the same job

---
 .gitea/workflows/test.yml | 46 +++++++++++++++++++++------------------
 1 file changed, 25 insertions(+), 21 deletions(-)

diff --git a/.gitea/workflows/test.yml b/.gitea/workflows/test.yml
index 50b596c..5631d53 100644
--- a/.gitea/workflows/test.yml
+++ b/.gitea/workflows/test.yml
@@ -26,17 +26,30 @@ jobs:
           username: ${{ gitea.actor }}
           password: ${{ secrets.REGISTRY_TOKEN }}
 
-      - name: Build and push dev image (PHP 8.4 + composer deps)
+      - name: Build dev image (PHP 8.4 + composer deps)
         uses: docker/build-push-action@v5
         with:
           context: .
           file: Dockerfile.dev
           target: dev
-          push: true
-          tags: ${{ env.REGISTRY }}/${{ gitea.repository }}:ci-${{ gitea.sha }}
+          load: true
+          tags: graph-dev:ci
           cache-from: type=registry,ref=${{ env.REGISTRY }}/${{ gitea.repository }}:buildcache-dev
           cache-to: type=registry,ref=${{ env.REGISTRY }}/${{ gitea.repository }}:buildcache-dev,mode=max
 
+      - name: Run tests in dev image
+        run: |
+          cid=$(docker create graph-dev:ci sh -c "
+            composer install --no-interaction &&
+            vendor/bin/phpunit --testdox &&
+            composer phpstan
+          ")
+          docker cp . "$cid":/app
+          rc=0
+          docker start -a "$cid" || rc=$?
+          docker rm "$cid" > /dev/null
+          exit $rc
+
   build-prod:
     needs: build-dev
     runs-on: ubuntu-latest
@@ -47,6 +60,13 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
 
+      - name: Log in to Gitea registry
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ gitea.actor }}
+          password: ${{ secrets.REGISTRY_TOKEN }}
+
       - name: Build prod image (final target)
         uses: docker/build-push-action@v5
         with:
@@ -54,21 +74,5 @@ jobs:
           file: Dockerfile
           target: final
           push: false
-
-  test:
-    needs: build-dev
-    runs-on: ubuntu-latest
-    container:
-      image: ${{ env.REGISTRY }}/${{ gitea.repository }}:ci-${{ gitea.sha }}
-      credentials:
-        username: ${{ gitea.actor }}
-        password: ${{ secrets.REGISTRY_TOKEN }}
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Run tests
-        run: |
-          composer install --no-interaction
-          vendor/bin/phpunit --testdox
-          composer phpstan
+          cache-from: type=registry,ref=${{ env.REGISTRY }}/${{ gitea.repository }}:buildcache-prod
+          cache-to: type=registry,ref=${{ env.REGISTRY }}/${{ gitea.repository }}:buildcache-prod,mode=max
-- 
2.54.0