From e67fb36fdd6cea62741a9f087a2aceffacd0e089 Mon Sep 17 00:00:00 2001
From: Scot Lunsford <slunsford@mitre.org>
Date: Wed, 9 Sep 2026 09:17:27 -0500
Subject: [PATCH 1/2] ci: run release workflows from version tags

Limit release creation, GitHub Pages deployment, and Docker publishing to version tag pushes.

Keep Docker latest publishing for releases while removing branch-triggered develop and master publishing.
---
 .github/workflows/create-release.yml |  8 ++++++--
 .github/workflows/github-pages.yml   |  8 ++++++--
 .github/workflows/publish.yml        | 15 +++++++--------
 CHANGELOG.md                         |  2 ++
 4 files changed, 21 insertions(+), 12 deletions(-)

diff --git a/.github/workflows/create-release.yml b/.github/workflows/create-release.yml
index 79a428e8e..6e25952e5 100644
--- a/.github/workflows/create-release.yml
+++ b/.github/workflows/create-release.yml
@@ -3,7 +3,7 @@ name: Create Release
 on:
   push:
     tags:
-      - '*'
+      - 'v*.*.*'
 
 jobs:
   create_github_release:
@@ -11,9 +11,13 @@ jobs:
     permissions:
       contents: write
     steps:
+    - name: Validate release tag
+      run: |
+        [[ "${GITHUB_REF_NAME}" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]
+
     - uses: actions/checkout@v4
     - uses: ncipollo/release-action@v1
       with:
         makeLatest: true
         name: "attack-navigator ${{github.ref_name}}"
-        body: "See [the changelog](./CHANGELOG.md) for details about what changed in this release."
\ No newline at end of file
+        body: "See [the changelog](./CHANGELOG.md) for details about what changed in this release."
diff --git a/.github/workflows/github-pages.yml b/.github/workflows/github-pages.yml
index 627870cdb..80a990d59 100644
--- a/.github/workflows/github-pages.yml
+++ b/.github/workflows/github-pages.yml
@@ -2,7 +2,8 @@ name: GitHub Pages
 
 on:
   push:
-    branches: ["master"]
+    tags:
+      - 'v*.*.*'
 
 jobs:
   deploy-to-gh-pages:
@@ -18,6 +19,10 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
+      - name: Validate release tag
+        run: |
+          [[ "${GITHUB_REF_NAME}" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]
+
       - name: Use Node.js from .nvmrc
         uses: actions/setup-node@v4
         with:
@@ -58,7 +63,6 @@ jobs:
 
       - name: Deploy
         uses: peaceiris/actions-gh-pages@v3
-        if: ${{ github.ref == 'refs/heads/master' }}
         with:
           deploy_key: ${{ secrets.DEPLOY_KEY }}
           publish_dir: ./nav-app/dist/browser
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index dd9a7a7b3..0d89b1987 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -2,9 +2,6 @@ name: Build and Publish Docker Image
 
 on:
   push:
-    branches:
-      - 'master'
-      - 'develop'
     tags:
       - 'v*.*.*'
 
@@ -12,6 +9,10 @@ jobs:
   docker:
     runs-on: ubuntu-latest
     steps:
+      - name: Validate release tag
+        run: |
+          [[ "${GITHUB_REF_NAME}" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]
+
       - name: Checkout
         uses: actions/checkout@v3
       - name: Set Docker Image and Tags
@@ -21,10 +22,8 @@ jobs:
           images: |
             ghcr.io/mitre-attack/attack-navigator
           tags: |
-            # set latest tag for master branch
-            type=raw,value=latest,enable=${{ github.ref == format('refs/heads/{0}', 'master') }}
-            # set develop tag for develop branch
-            type=ref,event=branch,enable=${{ github.ref == format('refs/heads/{0}', 'develop') }}
+            # set latest tag on release tag event
+            type=raw,value=latest
             # set semver tag (vX.Y.Z) on git tag event
             type=semver,pattern=v{{major}}.{{minor}}.{{patch}}
             # set git short commit as Docker tag (e.g., sha-ad132f5)
@@ -49,4 +48,4 @@ jobs:
           build-args: |
             BUILDTIME=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.created'] }}
             VERSION=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.version'] }}
-            REVISION=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.revision'] }}
\ No newline at end of file
+            REVISION=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.revision'] }}
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 3b057a1bb..620fd65b6 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,7 +5,9 @@
          npm version major
          npm version minor
          npm version patch
+
     This will patch the version number appropriately and create the correct tag on the current commit.
+    Pushing a stable vX.Y.Z tag triggers the GitHub Release, GitHub Pages deployment, and Docker image publish workflows.
     The creation of the tag can be disabled with the --no-git-tag-version if desired.
 -->
 # 5.3.2 - 21 April 2026

From f4c15efe8ee8d63709e488676c4a033021881aa7 Mon Sep 17 00:00:00 2001
From: Jared Ondricek <jondricek@mitre.org>
Date: Thu, 10 Sep 2026 15:05:49 -0500
Subject: [PATCH 2/2] fix(ci): serialize GitHub Pages deployments

---
 .github/workflows/github-pages.yml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/github-pages.yml b/.github/workflows/github-pages.yml
index 80a990d59..8f91c916f 100644
--- a/.github/workflows/github-pages.yml
+++ b/.github/workflows/github-pages.yml
@@ -11,7 +11,9 @@ jobs:
     permissions:
       contents: write
     concurrency:
-      group: ${{ github.workflow }}-${{ github.ref }}
+      # Every release updates the same gh-pages branch, so serialize deployments
+      # across tags instead of allowing each tag to deploy concurrently.
+      group: ${{ github.workflow }}
     defaults:
       run:
         working-directory: ./nav-app/