Correct syntax in docker.yaml workflow

.github/workflows/docker.yaml

@@ -7,8 +7,11 @@ on:
     tags: ["v*"]
     branches: [ main ]
   workflow_dispatch:
-  # Run on pull requests to test docker build.
-  # We explicitly do not push on pull requests (the job below is ended early).
+  # Run on pull requests so that the docker build is tested.
+  #
+  # We explicitly do not push on pull requests (see `if` conditionals and `push`
+  # attribute of `docker/build-push-action` below). This prevents us from filling
+  # up the container registries with in-progress builds.
   #
   # note: secrets will not be populated on pull requests from external authors.
   pull_request:
@@ -38,20 +41,16 @@ jobs:
             type=sha,prefix=,format=long
             type=semver,pattern=v{{version}}
             type=semver,pattern=v{{major}}.{{minor}}
-
-      - name: Don't push to registry if this is a PR
-        if: "${{ github.event_name }}" = "pull_request"
-        run: |
-          echo "Not pushing the image to any container registry as this workflow is running on a pull request"
-          exit 0
 
       - name: Log in to DockerHub
+        if: github.event_name != 'pull_request'
         uses: docker/login-action@v2
         with:
           username: ${{ secrets.DOCKER_HUB_USERNAME }}
           password: ${{ secrets.DOCKER_HUB_TOKEN }}
 
       - name: Log in to GHCR
+        if: github.event_name != 'pull_request'
         uses: docker/login-action@v2
         with:
           registry: ghcr.io
@@ -61,7 +60,8 @@ jobs:
       - name: Build and push all platforms
         uses: docker/build-push-action@v4
         with:
-          push: true
+          # Always build, but don't push to container registries on PRs.
+          push: ${{ github.event_name != 'pull_request' }}
           labels: "gitsha1=${{ github.sha }}"
           tags: "${{ steps.set-tag.outputs.tags }}"
           platforms: linux/amd64,linux/arm64