feat: enhance CI/CD pipeline with publish stage and image handling

.gitlab-ci.yml

@@ -1,9 +1,19 @@
 stages:
   - test
+  - publish
+
+workflow:
+  rules:
+    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
+    - if: '$CI_COMMIT_TAG'
+    - if: '$CI_COMMIT_BRANCH && $CI_OPEN_MERGE_REQUESTS && $CI_PIPELINE_SOURCE == "push"'
+      when: never
+    - if: '$CI_COMMIT_BRANCH'
 
 backend-test:
   stage: test
   image: maven:3.9-eclipse-temurin-25-alpine
+  interruptible: true
   script:
     - cd backend
     - mvn clean verify
@@ -11,8 +21,49 @@ backend-test:
 frontend-test:
   stage: test
   image: node:26-alpine
+  interruptible: true
   script:
     - npm install -g bun
     - cd frontend
     - bun install --frozen-lockfile
+    - bun run lint
+    - bun run typecheck
     - bun run test --coverage --watch=false
+
+.publish-image:
+  stage: publish
+  image: quay.io/buildah/stable:latest
+  variables:
+    STORAGE_DRIVER: vfs
+    BUILDAH_FORMAT: docker
+  before_script:
+    - echo "$CI_REGISTRY_PASSWORD" | buildah login --username "$CI_REGISTRY_USER" --password-stdin "$CI_REGISTRY"
+  script:
+    - |
+      if [ -n "$CI_COMMIT_TAG" ]; then
+        IMAGE_TAG="$CI_COMMIT_REF_SLUG"
+      else
+        IMAGE_TAG="latest"
+      fi
+      buildah build \
+        --pull-always \
+        --tag "$IMAGE_NAME:$CI_COMMIT_SHA" \
+        --tag "$IMAGE_NAME:$IMAGE_TAG" \
+        "$BUILD_CONTEXT"
+      buildah push "$IMAGE_NAME:$CI_COMMIT_SHA"
+      buildah push "$IMAGE_NAME:$IMAGE_TAG"
+  rules:
+    - if: '$CI_COMMIT_TAG'
+    - if: '$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'
+
+publish-backend-image:
+  extends: .publish-image
+  variables:
+    IMAGE_NAME: "$CI_REGISTRY_IMAGE/backend"
+    BUILD_CONTEXT: backend
+
+publish-frontend-image:
+  extends: .publish-image
+  variables:
+    IMAGE_NAME: "$CI_REGISTRY_IMAGE/frontend"
+    BUILD_CONTEXT: frontend