Test container before pushing to Docker registry

We've been burnt before by pushing untested container images and then
breaking debos/fakemachine CI jobs.

Run the unit tests from the last tagged version of fakemachine/debos
(which have already been tested) before pushing the container image to
the registry.

Fixes: #19
Signed-off-by: Christopher Obbard <[email protected]>

.github/workflows/container.yaml

@@ -17,6 +17,8 @@ jobs:
   build-containers:
     runs-on: ubuntu-latest
     name: Build ${{ matrix.variant }} container
+    env:
+      TEST_TAG: ${{ github.repository }}-${{ matrix.variant }}-testbuild
     permissions:
       contents: read
       packages: write
@@ -63,7 +65,24 @@ jobs:
             "type=ref,event=tag"
             "type=ref,event=pr"
 
-      - name: Build and push Docker image
+      - name: Build Docker image
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          file: Dockerfile.${{ matrix.dockerfile }}
+          load: true
+          push: false
+          tags: ${{ env.TEST_TAG }}
+          labels: ${{ steps.meta.outputs.labels }}
+          build-args: |
+            VARIANT=${{ matrix.variant }}
+
+      # TODO: actually do something useful here
+      - name: Test Docker image
+        run: |
+          docker run --rm ${{ env.TEST_TAG }} go run github.com/go-debos/debos/cmd/debos@latest
+
+      - name: Push Docker image
         uses: docker/build-push-action@v5
         with:
           context: .