ci(devcontainer-base): validate downstream checks before push

Author: robarnold

.github/workflows/image-devcontainer-base.yml

@@ -15,7 +15,11 @@ on: # yamllint disable-line rule:truthy
       - .github/workflows/image-devcontainer-base.yml
       - images/devcontainer-base/**
   schedule:
-      - cron: '0 0 * * 0'  # Triggers every Sunday at midnight UTC
+    - cron: "0 0 * * 0" # Triggers every Sunday at midnight UTC
+
+concurrency:
+  cancel-in-progress: true
+  group: devcontainer-base-${{ github.ref }}
 
 jobs:
   build-container:
@@ -38,10 +42,23 @@ jobs:
         id: metadata
         with:
           images: ghcr.io/${{ github.repository_owner }}/devcontainer-base
-      - name: Build Image
+      - name: Build Candidate Image
         uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
           context: images/devcontainer-base
           file: images/devcontainer-base/Containerfile
-          push: ${{ github.event_name != 'pull_request' }}
+          load: true
+          push: false
           tags: ghcr.io/${{ github.repository_owner }}/devcontainer-base:latest
+      - name: Validate Downstream Checks
+        uses: devcontainers/ci@513af61f4de4f75d37e4438f184ba4358f0fc1ca # v0.3.1900000450
+        with:
+          cacheFrom: ghcr.io/marinatedconcrete/config-devcontainer
+          env: |
+            CI=1
+          imageName: config-devcontainer-candidate
+          push: never
+          runCmd: just check-format && just lint && just test
+      - name: Push Tested Image
+        if: github.event_name != 'pull_request'
+        run: docker push ghcr.io/${{ github.repository_owner }}/devcontainer-base:latest