diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 60d54f81..2bbbd323 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -12,7 +12,7 @@ env:
   DB_PASSWORD: mysql
 
 jobs:
-  laravel-tests:
+  tests:
     runs-on: ubuntu-latest
     environment: Build
     steps:
@@ -35,12 +35,6 @@ jobs:
         restore-keys: |
           ${{ runner.os }}-node-
 
-    - name: Docker Login
-      uses: docker/login-action@v3
-      with:
-        username: esacci
-        password: ${{ secrets.DOCKER_ACCESS_TOKEN }}
-
     - name: Setup PHP
       uses: shivammathur/setup-php@v2
       with:
@@ -85,22 +79,34 @@ jobs:
     - name: Execute tests (Unit and Feature tests) via PHPUnit
       run: vendor/bin/phpunit -c phpunit.xml --coverage-clover=coverage.xml
 
-    - name: Upload to codecov
-      uses: codecov/codecov-action@v3
+  publish:
+    runs-on: ubuntu-latest
+    needs: tests
+    if: github.secret_source == 'Actions' || github.secret_source == 'Dependabot'
+    steps:
+    - name: Docker Login
+      uses: docker/login-action@v3
       with:
-        token: ${{ secrets.CODECOV_TOKEN }}
-        file: coverage.xml
-        fail_ci_if_error: true
+        username: esacci
+        password: ${{ secrets.DOCKER_ACCESS_TOKEN }}
 
-    - name: Build and push Docker images
+    - name: Build and push Docker image
       uses: docker/build-push-action@v5
       with:
         push: true
         tags: esac/website:${{ github.run_number }}
 
+    - name: Upload to codecov
+      uses: codecov/codecov-action@v3
+      if: secrets.CODECOV_TOKEN
+      with:
+        token: ${{ secrets.CODECOV_TOKEN }}
+        file: coverage.xml
+        fail_ci_if_error: true
+
   deploy:
     runs-on: ubuntu-latest
-    needs: laravel-tests
+    needs: publish
     if: github.event_name == 'push' && github.ref == 'refs/heads/master'
     steps:
     - name: Deploy via SSH
@@ -109,4 +115,4 @@ jobs:
         host: ${{ secrets.SSH_HOST }}
         user: ic
         private_key: ${{ secrets.SSH_PRIVATE_KEY }}
-        command: ./update.sh website "${{ github.run_number }}" "${{ github.actor }}" "${{ github.event.head_commit.message }}" "${{ github.event.head_commit.timestamp }}" "${{ github.ref }}"
\ No newline at end of file
+        command: ./update.sh website "${{ github.run_number }}" "${{ github.actor }}" "${{ github.event.head_commit.message }}" "${{ github.event.head_commit.timestamp }}" "${{ github.ref }}"