diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 256b8e7..3dd1427 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -67,7 +67,6 @@ jobs:
     env:
       DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
       DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
-      OCELOT_REF: ${{ github.event.client_payload.ref }}
     steps:
       - name: Checkout code
         uses: actions/checkout@v3
@@ -112,6 +111,58 @@ jobs:
       - name: Upload to dockerhub
         run: deployment/scripts/branded-images.upload.sh
 
+  github_tag:
+    name: Tag latest version on Github
+    runs-on: ubuntu-latest
+    needs: [upload_to_dockerhub]
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v3
+      - name: Decrypt .env
+        run: gpg --quiet --batch --yes --decrypt --passphrase="${SECRET}" --output .env .env.enc
+      - name: Load .env
+        uses: aarcangeli/load-dotenv@v1.0.0
+        with:
+          quiet: true
+      - name: Checkout Ocelot code
+        uses: actions/checkout@v3
+        with:
+          repository: 'Ocelot-Social-Community/Ocelot-Social'
+          ref: ${{ env.GITHUB_OCELOT_REF }}
+          path: 'ocelot/'
+          fetch-depth: 0 
+      - name: Setup env
+        run: |
+          echo "OCELOT_VERSION=$(node -p -e "require('./ocelot/package.json').version")" >> $GITHUB_ENV
+          echo "BRANDED_VERSION=${GITHUB_RUN_NUMBER}" >> $GITHUB_ENV
+          echo "BUILD_DATE=$(date -u +'%Y-%m-%dT%H:%M:%SZ')" >> $GITHUB_ENV
+          echo "BUILD_COMMIT=${GITHUB_SHA}" >> $GITHUB_ENV
+      - run: echo "BUILD_VERSION=${BRANDED_VERSION}-ocelot.social${OCELOT_VERSION}" >> $GITHUB_ENV
+      - name: package-version-to-git-tag + build number
+        uses: pkgdeps/git-tag-action@v2
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          github_repo: ${{ github.repository }}
+          version: ${{ env.BUILD_VERSION }}
+          git_commit_sha: ${{ github.sha }}
+          git_tag_prefix: "b"
+      #- name: Generate changelog
+      #  run: |
+      #    yarn install
+      #    yarn auto-changelog --latest-version ${{ env.VERSION }} --unreleased-only
+      - name: package-version-to-git-release
+        continue-on-error: true # Will fail if tag exists
+        id: create_release
+        uses: actions/create-release@v1
+        env:
+          GITHUB_TOKEN: ${{ github.token }} #${{ secrets.GITHUB_TOKEN }} # This token is provided by Actions, you do not need to create your own token
+        with:
+          tag_name: ${{ env.BUILD_VERSION }}
+          release_name: ${{ env.BUILD_VERSION }}
+          #body_path: ./CHANGELOG.md
+          draft: false
+          prerelease: false
+
 # TODO correct version
   build_trigger:
     name: Trigger successful brand build