Automatically build except for direct pushes

it's a bit annoying that we have to use allow_failure to express that the docker job does not necessarily build.

This MR will also serve as testing for the rule