Gate the release on the lint and test jobs

The four workflows all triggered on the same push to main and ran fully
independently, so build-main.yml published a latest-main release even when
PHPUnit or the linters were red. `needs:` only works between jobs of one
workflow, so the checks move into build-main.yml and the package job now
depends on them.

Two gaps close along the way: the check workflows only ran on main pushes
and pull requests, so a v* tag was published entirely unverified, and
`npm run build` only ran on main, so no pull request ever exercised the
frontend build -- the workflow now runs on pull_request too, with the
publish step skipped so the job acts as a build check.

Build and publish deliberately stay in a single job; moving the tarball
between jobs would require actions/upload-artifact (unusable on this Gitea,
see CLAUDE.md) or actions/cache.

.gitea/workflows/build-main.yml

@@ -1,14 +1,73 @@
 name: Build package
 
+# One workflow for checks, build and release, because the publish step has to
+# depend on the checks and `needs:` only works between jobs of one workflow.
 on:
   push:
     branches:
       - main
     tags:
       - 'v*'
+  pull_request:
 
 jobs:
+  php-lint:
+    runs-on: gitea-runner-server03
+    strategy:
+      matrix:
+        php-version: ['8.2', '8.3', '8.4']
+    steps:
+      - uses: actions/checkout@v7
+
+      - uses: shivammathur/setup-php@v2
+        with:
+          php-version: ${{ matrix.php-version }}
+          coverage: none
+
+      - name: Syntax check
+        run: |
+          find lib tests appinfo -name '*.php' -print0 | xargs -0 -n1 -- php -l
+
+  xml-lint:
+    runs-on: gitea-runner-server03
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Install xmllint
+        run: |
+          apt-get update
+          apt-get install -y --no-install-recommends libxml2-utils
+
+      - name: Download appstore schema
+        run: wget -q https://raw.githubusercontent.com/nextcloud/appstore/master/nextcloudappstore/api/v1/release/info.xsd -O info.xsd
+
+      - name: Validate appinfo/info.xml
+        run: xmllint --schema info.xsd appinfo/info.xml --noout
+
+  unit-tests:
+    runs-on: gitea-runner-server03
+    steps:
+      - uses: actions/checkout@v7
+
+      - uses: shivammathur/setup-php@v2
+        with:
+          php-version: '8.3'
+          extensions: sqlite, pdo_sqlite
+          coverage: none
+
+      - name: Install dependencies
+        run: composer install --no-progress --prefer-dist
+
+      - name: Run unit tests
+        run: composer run test:unit
+
+  # Building and publishing stay in one job on purpose: handing the tarball to a
+  # separate publish job would mean actions/upload-artifact (unusable here, see
+  # CLAUDE.md) or actions/cache, and neither is worth a second Gitea backend API
+  # in the critical path. On a pull request this job stops after `make appstore`
+  # and just acts as a build check.
   package:
+    needs: [php-lint, xml-lint, unit-tests]
     runs-on: gitea-runner-server03
     # contents: write maps to Code: write (deleting the latest-main tag) plus
     # Releases: write (creating releases and uploading the asset) - everything
@@ -32,6 +91,7 @@ jobs:
         run: make appstore
 
       - name: Publish release
+        if: gitea.event_name == 'push'
         env:
           GITEA_API: ${{ gitea.server_url }}/api/v1
           REPO: ${{ gitea.repository }}