From 2fe5b6eb682d205ce1d7c76a26bb3f3048eee2f9 Mon Sep 17 00:00:00 2001
From: Douglas Lowe <10961945+douglowe@users.noreply.github.com>
Date: Tue, 6 May 2025 22:31:37 +0100
Subject: [PATCH 01/17] flaskuser in docker container

---
 Dockerfile | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/Dockerfile b/Dockerfile
index 08b905a..54b5057 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -12,6 +12,11 @@ RUN pip install --no-cache-dir -r requirements.txt
 
 COPY . .
 
+RUN useradd -ms /bin/bash flaskuser
+RUN chown -R flaskuser:flaskuser /app
+
+USER flaskuser
+
 EXPOSE 5000
 
 CMD ["flask", "run", "--host=0.0.0.0"]

From e0402a732ab5db2e483781f02c61f1c6a6bcb09d Mon Sep 17 00:00:00 2001
From: Douglas Lowe <10961945+douglowe@users.noreply.github.com>
Date: Tue, 6 May 2025 22:38:18 +0100
Subject: [PATCH 02/17] gh actions build script

---
 .github/workflows/build.yml | 56 +++++++++++++++++++++++++++++++++++++
 1 file changed, 56 insertions(+)
 create mode 100644 .github/workflows/build.yml

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
new file mode 100644
index 0000000..6109321
--- /dev/null
+++ b/.github/workflows/build.yml
@@ -0,0 +1,56 @@
+#
+name: Create and publish a Docker image
+
+# Configures this workflow to run every time a change is pushed to the branch called `release`.
+on:
+  pull-request:
+    branches: ['ghaction-build']
+  workflow_dispatch:
+
+env:
+  REGISTRY: ghcr.io
+  IMAGE_NAME: ${{ github.repository }}
+
+jobs:
+  build-and-push-image:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+      attestations: write
+      id-token: write
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+      - name: Log in to the Container registry
+        uses: docker/login-action@65b78e6e13532edd9afa3aa52ac7964289d1a9c1
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      # This step uses [docker/metadata-action](https://github.com/docker/metadata-action#about) to extract tags and labels that will be applied to the specified image. The `id` "meta" allows the output of this step to be referenced in a subsequent step. The `images` value provides the base name for the tags and labels.
+      - name: Extract metadata (tags, labels) for Docker
+        id: meta
+        uses: docker/metadata-action@9ec57ed1fcdbf14dcef7dfbe97b2010124a938b7
+        with:
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+      # This step uses the `docker/build-push-action` action to build the image, based on your repository's `Dockerfile`. If the build succeeds, it pushes the image to GitHub Packages.
+      # It uses the `context` parameter to define the build's context as the set of files located in the specified path. For more information, see [Usage](https://github.com/docker/build-push-action#usage) in the README of the `docker/build-push-action` repository.
+      # It uses the `tags` and `labels` parameters to tag and label the image with the output from the "meta" step.
+      - name: Build and push Docker image
+        id: push
+        uses: docker/build-push-action@f2a1d5e99d037542a71f64918e516c093c6f3fc4
+        with:
+          context: .
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+      
+      # This step generates an artifact attestation for the image, which is an unforgeable statement about where and how it was built. It increases supply chain security for people who consume the image. For more information, see [Using artifact attestations to establish provenance for builds](/actions/security-guides/using-artifact-attestations-to-establish-provenance-for-builds).
+      - name: Generate artifact attestation
+        uses: actions/attest-build-provenance@v2
+        with:
+          subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME}}
+          subject-digest: ${{ steps.push.outputs.digest }}
+          push-to-registry: true
+      
\ No newline at end of file

From cbb1a2b49974999e11a58707b11888ba52c490c9 Mon Sep 17 00:00:00 2001
From: Douglas Lowe <10961945+douglowe@users.noreply.github.com>
Date: Tue, 6 May 2025 22:40:46 +0100
Subject: [PATCH 03/17] correct build action trigger

---
 .github/workflows/build.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 6109321..40bdc68 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -3,9 +3,9 @@ name: Create and publish a Docker image
 
 # Configures this workflow to run every time a change is pushed to the branch called `release`.
 on:
-  pull-request:
+  push:
     branches: ['ghaction-build']
-  workflow_dispatch:
+  pull-request:
 
 env:
   REGISTRY: ghcr.io

From e82a35bb1d00b3185bedb3c22d9002fd97b2873b Mon Sep 17 00:00:00 2001
From: Douglas Lowe <10961945+douglowe@users.noreply.github.com>
Date: Tue, 6 May 2025 22:41:58 +0100
Subject: [PATCH 04/17] correct build action trigger again

---
 .github/workflows/build.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 40bdc68..d7133a7 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -3,9 +3,9 @@ name: Create and publish a Docker image
 
 # Configures this workflow to run every time a change is pushed to the branch called `release`.
 on:
-  push:
+  pull_request:
     branches: ['ghaction-build']
-  pull-request:
+  workflow_dispatch:
 
 env:
   REGISTRY: ghcr.io

From ab2cadf2278f8e06c25e51d7434914892a9de674 Mon Sep 17 00:00:00 2001
From: Douglas Lowe <10961945+douglowe@users.noreply.github.com>
Date: Tue, 6 May 2025 23:08:31 +0100
Subject: [PATCH 05/17] add image source

---
 Dockerfile | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/Dockerfile b/Dockerfile
index 54b5057..776cb5e 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -20,3 +20,5 @@ USER flaskuser
 EXPOSE 5000
 
 CMD ["flask", "run", "--host=0.0.0.0"]
+
+LABEL org.opencontainers.image.source="https://github.com/eScienceLab/Cratey-Validator"
\ No newline at end of file

From 5f0d003ec0f6b9d486c0c5cadbf2461e83bdf8b5 Mon Sep 17 00:00:00 2001
From: Douglas Lowe <10961945+douglowe@users.noreply.github.com>
Date: Tue, 6 May 2025 23:12:16 +0100
Subject: [PATCH 06/17] alter package name for test visibility

---
 .github/workflows/build.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index d7133a7..731b600 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -50,7 +50,7 @@ jobs:
       - name: Generate artifact attestation
         uses: actions/attest-build-provenance@v2
         with:
-          subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME}}
+          subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME}}-test
           subject-digest: ${{ steps.push.outputs.digest }}
           push-to-registry: true
       
\ No newline at end of file

From 8191f1966e7cfd9d1db7f451f523d7f6d2ea0f18 Mon Sep 17 00:00:00 2001
From: Douglas Lowe <10961945+douglowe@users.noreply.github.com>
Date: Tue, 6 May 2025 23:15:11 +0100
Subject: [PATCH 07/17] alter package name for test visibility (extra)

---
 .github/workflows/build.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 731b600..8400c49 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -33,7 +33,7 @@ jobs:
         id: meta
         uses: docker/metadata-action@9ec57ed1fcdbf14dcef7dfbe97b2010124a938b7
         with:
-          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-test
       # This step uses the `docker/build-push-action` action to build the image, based on your repository's `Dockerfile`. If the build succeeds, it pushes the image to GitHub Packages.
       # It uses the `context` parameter to define the build's context as the set of files located in the specified path. For more information, see [Usage](https://github.com/docker/build-push-action#usage) in the README of the `docker/build-push-action` repository.
       # It uses the `tags` and `labels` parameters to tag and label the image with the output from the "meta" step.

From d1f7ed06ef6490d5a44603ad31d6fc58661f5190 Mon Sep 17 00:00:00 2001
From: Douglas Lowe <10961945+douglowe@users.noreply.github.com>
Date: Wed, 7 May 2025 13:14:37 +0100
Subject: [PATCH 08/17] package name change test

---
 .github/workflows/build.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 8400c49..951367d 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -33,7 +33,7 @@ jobs:
         id: meta
         uses: docker/metadata-action@9ec57ed1fcdbf14dcef7dfbe97b2010124a938b7
         with:
-          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-test
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-test-public
       # This step uses the `docker/build-push-action` action to build the image, based on your repository's `Dockerfile`. If the build succeeds, it pushes the image to GitHub Packages.
       # It uses the `context` parameter to define the build's context as the set of files located in the specified path. For more information, see [Usage](https://github.com/docker/build-push-action#usage) in the README of the `docker/build-push-action` repository.
       # It uses the `tags` and `labels` parameters to tag and label the image with the output from the "meta" step.
@@ -50,7 +50,7 @@ jobs:
       - name: Generate artifact attestation
         uses: actions/attest-build-provenance@v2
         with:
-          subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME}}-test
+          subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME}}-test-public
           subject-digest: ${{ steps.push.outputs.digest }}
           push-to-registry: true
       
\ No newline at end of file

From 1e7071e9146b6dba2883256737a7316acb8a5eb1 Mon Sep 17 00:00:00 2001
From: Douglas Lowe <10961945+douglowe@users.noreply.github.com>
Date: Wed, 7 May 2025 13:20:29 +0100
Subject: [PATCH 09/17] make visibility public

---
 .github/workflows/build.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 951367d..69997ec 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -45,6 +45,7 @@ jobs:
           push: true
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
+          visibility: public
       
       # This step generates an artifact attestation for the image, which is an unforgeable statement about where and how it was built. It increases supply chain security for people who consume the image. For more information, see [Using artifact attestations to establish provenance for builds](/actions/security-guides/using-artifact-attestations-to-establish-provenance-for-builds).
       - name: Generate artifact attestation

From 62fd66f492168a60d0777e7a1875901eea565201 Mon Sep 17 00:00:00 2001
From: Douglas Lowe <10961945+douglowe@users.noreply.github.com>
Date: Wed, 7 May 2025 13:22:31 +0100
Subject: [PATCH 10/17] package name change test

---
 .github/workflows/build.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 69997ec..1d02386 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -33,7 +33,7 @@ jobs:
         id: meta
         uses: docker/metadata-action@9ec57ed1fcdbf14dcef7dfbe97b2010124a938b7
         with:
-          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-test-public
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-test-public2
       # This step uses the `docker/build-push-action` action to build the image, based on your repository's `Dockerfile`. If the build succeeds, it pushes the image to GitHub Packages.
       # It uses the `context` parameter to define the build's context as the set of files located in the specified path. For more information, see [Usage](https://github.com/docker/build-push-action#usage) in the README of the `docker/build-push-action` repository.
       # It uses the `tags` and `labels` parameters to tag and label the image with the output from the "meta" step.
@@ -51,7 +51,7 @@ jobs:
       - name: Generate artifact attestation
         uses: actions/attest-build-provenance@v2
         with:
-          subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME}}-test-public
+          subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME}}-test-public2
           subject-digest: ${{ steps.push.outputs.digest }}
           push-to-registry: true
       
\ No newline at end of file

From 9cb5ea3c1b2a3a4ec8d0aa0a967c620f456dee92 Mon Sep 17 00:00:00 2001
From: Douglas Lowe <10961945+douglowe@users.noreply.github.com>
Date: Wed, 7 May 2025 13:57:12 +0100
Subject: [PATCH 11/17] unpin docker actions

---
 .github/workflows/build.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 1d02386..23ea894 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -23,7 +23,7 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v4
       - name: Log in to the Container registry
-        uses: docker/login-action@65b78e6e13532edd9afa3aa52ac7964289d1a9c1
+        uses: docker/login-action
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
@@ -31,7 +31,7 @@ jobs:
       # This step uses [docker/metadata-action](https://github.com/docker/metadata-action#about) to extract tags and labels that will be applied to the specified image. The `id` "meta" allows the output of this step to be referenced in a subsequent step. The `images` value provides the base name for the tags and labels.
       - name: Extract metadata (tags, labels) for Docker
         id: meta
-        uses: docker/metadata-action@9ec57ed1fcdbf14dcef7dfbe97b2010124a938b7
+        uses: docker/metadata-action
         with:
           images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-test-public2
       # This step uses the `docker/build-push-action` action to build the image, based on your repository's `Dockerfile`. If the build succeeds, it pushes the image to GitHub Packages.
@@ -39,7 +39,7 @@ jobs:
       # It uses the `tags` and `labels` parameters to tag and label the image with the output from the "meta" step.
       - name: Build and push Docker image
         id: push
-        uses: docker/build-push-action@f2a1d5e99d037542a71f64918e516c093c6f3fc4
+        uses: docker/build-push-action
         with:
           context: .
           push: true

From 0d673c05d861ca4e6233c0f95ccf80d147fe9aa9 Mon Sep 17 00:00:00 2001
From: Douglas Lowe <10961945+douglowe@users.noreply.github.com>
Date: Wed, 7 May 2025 14:02:01 +0100
Subject: [PATCH 12/17] Revert "unpin docker actions"

This reverts commit 9cb5ea3c1b2a3a4ec8d0aa0a967c620f456dee92.
---
 .github/workflows/build.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 23ea894..1d02386 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -23,7 +23,7 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v4
       - name: Log in to the Container registry
-        uses: docker/login-action
+        uses: docker/login-action@65b78e6e13532edd9afa3aa52ac7964289d1a9c1
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
@@ -31,7 +31,7 @@ jobs:
       # This step uses [docker/metadata-action](https://github.com/docker/metadata-action#about) to extract tags and labels that will be applied to the specified image. The `id` "meta" allows the output of this step to be referenced in a subsequent step. The `images` value provides the base name for the tags and labels.
       - name: Extract metadata (tags, labels) for Docker
         id: meta
-        uses: docker/metadata-action
+        uses: docker/metadata-action@9ec57ed1fcdbf14dcef7dfbe97b2010124a938b7
         with:
           images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-test-public2
       # This step uses the `docker/build-push-action` action to build the image, based on your repository's `Dockerfile`. If the build succeeds, it pushes the image to GitHub Packages.
@@ -39,7 +39,7 @@ jobs:
       # It uses the `tags` and `labels` parameters to tag and label the image with the output from the "meta" step.
       - name: Build and push Docker image
         id: push
-        uses: docker/build-push-action
+        uses: docker/build-push-action@f2a1d5e99d037542a71f64918e516c093c6f3fc4
         with:
           context: .
           push: true

From 5ac3acc489a8ad5a260af3a2a2c07cac88620f48 Mon Sep 17 00:00:00 2001
From: Douglas Lowe <10961945+douglowe@users.noreply.github.com>
Date: Wed, 7 May 2025 14:15:24 +0100
Subject: [PATCH 13/17] use login-action v3

---
 .github/workflows/build.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 1d02386..b71a570 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -23,7 +23,7 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v4
       - name: Log in to the Container registry
-        uses: docker/login-action@65b78e6e13532edd9afa3aa52ac7964289d1a9c1
+        uses: docker/login-action@v3
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}

From 43dfef83697a39169fd9ce7129933a77192f6df2 Mon Sep 17 00:00:00 2001
From: Douglas Lowe <10961945+douglowe@users.noreply.github.com>
Date: Wed, 7 May 2025 14:20:30 +0100
Subject: [PATCH 14/17] use metadata-action v5

---
 .github/workflows/build.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index b71a570..0cb110c 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -31,7 +31,7 @@ jobs:
       # This step uses [docker/metadata-action](https://github.com/docker/metadata-action#about) to extract tags and labels that will be applied to the specified image. The `id` "meta" allows the output of this step to be referenced in a subsequent step. The `images` value provides the base name for the tags and labels.
       - name: Extract metadata (tags, labels) for Docker
         id: meta
-        uses: docker/metadata-action@9ec57ed1fcdbf14dcef7dfbe97b2010124a938b7
+        uses: docker/metadata-action@v5
         with:
           images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-test-public2
       # This step uses the `docker/build-push-action` action to build the image, based on your repository's `Dockerfile`. If the build succeeds, it pushes the image to GitHub Packages.

From 2ac0967bbf66c121e45f5f58e64f271ec567caad Mon Sep 17 00:00:00 2001
From: Douglas Lowe <10961945+douglowe@users.noreply.github.com>
Date: Wed, 7 May 2025 14:44:11 +0100
Subject: [PATCH 15/17] build-push-action v6

---
 .github/workflows/build.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 0cb110c..4295e13 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -39,7 +39,7 @@ jobs:
       # It uses the `tags` and `labels` parameters to tag and label the image with the output from the "meta" step.
       - name: Build and push Docker image
         id: push
-        uses: docker/build-push-action@f2a1d5e99d037542a71f64918e516c093c6f3fc4
+        uses: docker/build-push-action@v6
         with:
           context: .
           push: true

From a7bf977e38145b85e59662348ee302b206039b4b Mon Sep 17 00:00:00 2001
From: Douglas Lowe <10961945+douglowe@users.noreply.github.com>
Date: Wed, 7 May 2025 15:02:58 +0100
Subject: [PATCH 16/17] clean up build

---
 .github/workflows/build.yml | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 4295e13..aa5b0ea 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -33,7 +33,7 @@ jobs:
         id: meta
         uses: docker/metadata-action@v5
         with:
-          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-test-public2
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
       # This step uses the `docker/build-push-action` action to build the image, based on your repository's `Dockerfile`. If the build succeeds, it pushes the image to GitHub Packages.
       # It uses the `context` parameter to define the build's context as the set of files located in the specified path. For more information, see [Usage](https://github.com/docker/build-push-action#usage) in the README of the `docker/build-push-action` repository.
       # It uses the `tags` and `labels` parameters to tag and label the image with the output from the "meta" step.
@@ -45,13 +45,12 @@ jobs:
           push: true
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
-          visibility: public
       
       # This step generates an artifact attestation for the image, which is an unforgeable statement about where and how it was built. It increases supply chain security for people who consume the image. For more information, see [Using artifact attestations to establish provenance for builds](/actions/security-guides/using-artifact-attestations-to-establish-provenance-for-builds).
       - name: Generate artifact attestation
         uses: actions/attest-build-provenance@v2
         with:
-          subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME}}-test-public2
+          subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME}}
           subject-digest: ${{ steps.push.outputs.digest }}
           push-to-registry: true
       
\ No newline at end of file

From f7eb4f84280e16806e8c39915cf6293dba86efd8 Mon Sep 17 00:00:00 2001
From: Douglas Lowe <10961945+douglowe@users.noreply.github.com>
Date: Sun, 11 May 2025 21:05:17 +0100
Subject: [PATCH 17/17] switch to release trigger

---
 .github/workflows/build.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index aa5b0ea..497eda6 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -3,8 +3,8 @@ name: Create and publish a Docker image
 
 # Configures this workflow to run every time a change is pushed to the branch called `release`.
 on:
-  pull_request:
-    branches: ['ghaction-build']
+  release:
+    types: [published]
   workflow_dispatch:
 
 env: