- build.yml: determine image tag from branch (main=stable, other=test-<branch>) - build.yml: allow push on workflow_dispatch from any branch - build.yml: only sign images from main branch - build-installer-iso.yml: add image_tag input (default: stable)