diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index d82820d..0d3e18d 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -1,8 +1,7 @@
 name: CI
 
 on:
-  push:
-    branches: [ main ]
+  push: {}
   pull_request:
     branches: [ main ]
 
@@ -14,7 +13,6 @@ jobs:
     steps:
     - uses: earthly/actions-setup@v1
       with:
-        # version: v0.7.21
         github-token: ${{ secrets.GITHUB_TOKEN }}
 
     - uses: actions/checkout@v4
@@ -22,8 +20,17 @@ jobs:
         submodules: true
         fetch-depth: 0
 
-    - name: earthly +all
-      run: earthly --strict +all
+    - name: earthly +test
+      if: github.ref != 'refs/heads/main'
+      run: earthly --strict +test
+
+    - name: earthly +push
+      if: github.ref == 'refs/heads/main'
+      run: earthly --push --secret NUGET_API_KEY= --secret PSMODULE_PUBLISH_KEY --strict +all
+      env:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        NUGET_API_KEY: ${{ secrets.NUGET_API_KEY }}
+        PSMODULE_PUBLISH_KEY: ${{ secrets.PSMODULE_PUBLISH_KEY }}
 
     - uses: actions/upload-artifact@v3
       with:
diff --git a/Earthfile b/Earthfile
index a3d0ef1..a719dc0 100644
--- a/Earthfile
+++ b/Earthfile
@@ -3,6 +3,7 @@ IMPORT github.com/poshcode/tasks
 FROM mcr.microsoft.com/dotnet/sdk:7.0
 WORKDIR /work
 
+ARG --global EARTHLY_GIT_ORIGIN_URL
 ARG --global EARTHLY_BUILD_SHA
 ARG --global EARTHLY_GIT_BRANCH
 # These are my common paths, used in my shared /Tasks repo
@@ -12,8 +13,8 @@ ARG --global TEMP_ROOT=/temp
 # These are my common build args, used in my shared /Tasks repo
 ARG --global MODULE_NAME=Pansies
 ARG --global CONFIGURATION=Release
-ARG --global PSMODULE_PUBLISH_KEY
-ARG --global NUGET_API_KEY
+# ARG --global PSMODULE_PUBLISH_KEY
+# ARG --global NUGET_API_KEY
 
 worker:
     # Dotnet tools and scripts installed by PSGet
@@ -27,38 +28,41 @@ worker:
     # So the dependency cach only re-builds when you add a new dependency
     COPY RequiredModules.psd1 .
     COPY *.csproj .
-    RUN ["pwsh", "--file", "/Tasks/_Bootstrap.ps1", "-RequiredModulesPath", "RequiredModules.psd1"]
+    RUN ["pwsh", "-File", "/Tasks/_Bootstrap.ps1", "-RequiredModulesPath", "RequiredModules.psd1"]
 
 build:
     FROM +worker
     RUN mkdir $OUTPUT_ROOT $TEST_ROOT $TEMP_ROOT
     COPY . .
     # make sure you have bin and obj in .earthlyignore, as their content from context might cause problems
-    RUN ["pwsh", "--command", "Invoke-Build", "-Task", "Build", "-File", "Build.build.ps1"]
+    RUN ["pwsh", "-Command", "Invoke-Build", "-Task", "Build", "-File", "Build.build.ps1"]
 
     # SAVE ARTIFACT [--keep-ts] [--keep-own] [--if-exists] [--force] <src> [<artifact-dest-path>] [AS LOCAL <local-path>]
     SAVE ARTIFACT $OUTPUT_ROOT/$MODULE_NAME AS LOCAL ./Modules/$MODULE_NAME
 
 test:
     # If we run a target as a reference in FROM or COPY, it's outputs will not be produced
+    BUILD +build
     FROM +build
     # make sure you have bin and obj in .earthlyignore, as their content from context might cause problems
-    RUN ["pwsh", "--command", "Invoke-Build", "-Task", "Test", "-File", "Build.build.ps1"]
+    RUN ["pwsh", "-Command", "Invoke-Build", "-Task", "Test", "-File", "Build.build.ps1"]
 
     # SAVE ARTIFACT [--keep-ts] [--keep-own] [--if-exists] [--force] <src> [<artifact-dest-path>] [AS LOCAL <local-path>]
     SAVE ARTIFACT $TEST_ROOT AS LOCAL ./Modules/$MODULE_NAME-TestResults
 
 pack:
-    BUILD +build # So that we get the build artifact too
-    FROM +build
-    RUN ["pwsh", "--command", "Invoke-Build", "-Task", "Pack", "-File", "Build.build.ps1", "-Verbose"]
+    BUILD +test # So that we get the module artifact from build too
+    FROM +test
+    RUN ["pwsh", "-Command", "Invoke-Build", "-Task", "Pack", "-File", "Build.build.ps1", "-Verbose"]
     SAVE ARTIFACT $OUTPUT_ROOT/publish/*.nupkg AS LOCAL ./Modules/$MODULE_NAME-Packages/
 
-publish:
-    FROM +build
-    RUN ["pwsh", "--command", "Invoke-Build", "-Task", "Publish", "-File", "Build.build.ps1", "-Verbose"]
+push:
+    FROM +pack
+    RUN --push --secret NUGET_API_KEY --secret PSMODULE_PUBLISH_KEY -- \
+        pwsh -Command Invoke-Build -Task Publish -File Build.build.ps1 -Verbose
 
 all:
     # BUILD +build
     BUILD +test
     BUILD +pack
+    BUILD +push