Enable Docker base image updates

.github/workflows/build-and-push-bskyweb-ghcr.yaml

@@ -1,5 +1,12 @@
 name: build-and-push-bskyweb-ghcr
 on:
+  pull_request:
+    paths:
+      - Dockerfile
+      - Dockerfile.bskylink
+      - Dockerfile.bskyogcard
+      - Dockerfile.embedr
+      - .github/workflows/build-and-push-bskyweb-ghcr.yaml
   push:
     branches:
       - main
@@ -13,8 +20,40 @@ env:
   IMAGE_NAME: ${{ github.repository }}
 
 jobs:
+  verify-containers:
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - image: bskyweb
+            file: Dockerfile
+          - image: bskylink
+            file: Dockerfile.bskylink
+          - image: bskyogcard
+            file: Dockerfile.bskyogcard
+          - image: embedr
+            file: Dockerfile.embedr
+    steps:
+      - name: ⬇️ Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: 🔧 Setup Docker buildx
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+      - name: Build ${{ matrix.image }}
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        with:
+          context: .
+          file: ${{ matrix.file }}
+          platforms: linux/amd64
+          push: false
+          cache-from: type=gha,scope=${{ matrix.image }}
+          cache-to: type=gha,mode=max,scope=${{ matrix.image }}
+
   bskyweb-container-ghcr:
-    if: github.repository == 'bluesky-social/social-app'
+    if: github.event_name == 'push' && github.repository == 'bluesky-social/social-app'
     runs-on: ubuntu-latest
     permissions:
       contents: read