feat: add PostgreSQL variant of build & test workflow

Separate file because Gitea can't make services: conditional.
Service is reached by name on the job network; POSTGRES_* env is
passed to the test step.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

README.md

@@ -33,6 +33,35 @@ jobs:
 
 No secrets.
 
+## Variant with PostgreSQL
+
+`dotnet-build-test-postgres.yaml` runs the same steps as above, plus a PostgreSQL service container for integration tests. It has its own file because Gitea can't make `services:` conditional.
+
+```yaml
+jobs:
+  build-test:
+    uses: templates/dotnet-build-test/.gitea/workflows/dotnet-build-test-postgres.yaml@v1
+    with:
+      solution: MyApp.slnx
+      postgres-user: myapp
+      postgres-password: myapp
+      # postgres-image: postgres:17-alpine
+      # postgres-db: ""   # empty = same as postgres-user
+```
+
+It takes all inputs of `dotnet-build-test.yaml`, plus these:
+
+| Name | Default | Description |
+|---|---|---|
+| `postgres-image` | `postgres:17-alpine` | Service image |
+| `postgres-user` | `postgres` | Superuser, so it can create and drop databases |
+| `postgres-password` | `postgres` | Throwaway CI password, not a secret |
+| `postgres-db` | `""` | Database created at start. Empty means the same as `postgres-user` |
+
+The test step gets `POSTGRES_HOST=postgres`, `POSTGRES_PORT=5432`, `POSTGRES_USER`, `POSTGRES_PASSWORD` and `POSTGRES_DB` as environment variables. The job reaches the service by its name on the job network, which requires a container-mode runner. No host port is mapped. A step before the tests waits up to 60 s for the port to open.
+
+No secrets.
+
 ## Versioning
 
 Only major tags (`v1`, `v2`, …). Fixes and new optional inputs move the existing tag. Changing or removing inputs, or changing behavior, needs a new major tag.