diff --git a/.gitea/workflows/build-push.yml b/.gitea/workflows/build-push.yml
index 2da7cfc..750575a 100644
--- a/.gitea/workflows/build-push.yml
+++ b/.gitea/workflows/build-push.yml
@@ -2,7 +2,7 @@ name: Build and Push to ACR
 
 on:
   push:
-    branches: [ "dev" ]
+    branches: [ dev ]
   workflow_dispatch: {}
 
 concurrency:
@@ -16,6 +16,11 @@ jobs:
   build:
     name: Build and Push
     runs-on: ubuntu-latest
+    if: >-
+      github.ref != 'refs/heads/main' && (
+        github.event_name == 'workflow_dispatch' ||
+        (github.event_name == 'push' && github.event.before != '0000000000000000000000000000000000000000')
+      )
     permissions:
       contents: read
       id-token: write
@@ -23,52 +28,16 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
-      - name: Set up JDK 17
-        uses: actions/setup-java@v4
-        with:
-          distribution: 'temurin'
-          java-version: '17'
-      - name: Install Maven
-        run: |
-          if ! command -v mvn &>/dev/null; then
-            apt-get update -qq && apt-get install -y maven
-          fi
-          mvn --version
-      - name: Build with Maven
-        run: mvn clean package -DskipTests -Dcheckstyle.skip=true -B
-      - name: Run tests
-        # Exclude PostgresIntegrationTests — it hardcodes spring.docker.compose.skip.in-tests=false
-        # in its @SpringBootTest annotation, making it impossible to override via -D flags.
-        # docker-compose is not available in the act runner container.
-        # -Dtest=!ClassName is the correct Surefire 2.19+ CLI exclusion syntax.
-        # -Dcheckstyle.skip=true — platform-scaffolded files (score.yaml, k6/) contain
-        # internal http:// URLs that trip the NoHttp checkstyle plugin.
-        run: mvn test -B '-Dtest=!PostgresIntegrationTests' -Dcheckstyle.skip=true
-
-
-      - name: Security Scan - Trivy
-        continue-on-error: true
-        run: |
-          # Download release tarball directly — avoids install.sh which calls
-          # api.github.com/releases/tags/... and fails in network-restricted runners.
-          TRIVY_VERSION="0.57.1"
-          TRIVY_BIN="/tmp/trivy-bin/trivy"
-          if ! command -v trivy &>/dev/null; then
-            mkdir -p /tmp/trivy-bin
-            curl -sfLo /tmp/trivy.tar.gz               "https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz"
-            tar -xzf /tmp/trivy.tar.gz -C /tmp/trivy-bin trivy
-            chmod +x "${TRIVY_BIN}"
-          else
-            TRIVY_BIN="$(command -v trivy)"
-          fi
-          # Filesystem scan — exit-code 0 so findings are reported but never block the build
-          "${TRIVY_BIN}" fs             --severity HIGH,CRITICAL             --exit-code 0             --format table             --skip-db-update --offline-scan             .             || "${TRIVY_BIN}" fs                  --severity HIGH,CRITICAL                  --exit-code 0                  --format table                  .
 
       - name: Install Azure CLI
         run: |
-          if ! command -v az &>/dev/null; then
-            curl -sL https://aka.ms/InstallAzureCLIDeb | bash
-          fi
+          command -v az &>/dev/null || curl -sL https://aka.ms/InstallAzureCLIDeb | bash
+
+      - name: Install Docker CLI
+        run: |
+          command -v docker &>/dev/null || (apt-get update -qq && apt-get install -y docker.io)
+          docker --version
+
       - name: Azure login (OIDC)
         run: |
           az login \
@@ -76,13 +45,40 @@ jobs:
             --username "$AZURE_CLIENT_ID" \
             --tenant "$AZURE_TENANT_ID" \
             --federated-token "$(cat $AZURE_FEDERATED_TOKEN_FILE)"
-      - name: Build and push via ACR Tasks
+          echo "✓ Azure login successful"
+
+      - name: Get ACR details
         run: |
-          SHORT_SHA=$(echo "${{ gitea.sha }}" | cut -c1-7)
-          az acr build \
-            --registry bstagecjotdevacr \
-            --image reno-test-14:$SHORT_SHA \
-            --image reno-test-14:latest \
-            --file Dockerfile \
-            .
-          echo "✓ Pushed: bstagecjotdevacr.azurecr.io/reno-test-14:$SHORT_SHA"
+          ACR_NAME=$(az acr list --query "[0].name" -o tsv)
+          ACR_NAME="${ACR_NAME:-bstagecjotdevacr}"
+          echo "ACR_NAME=$ACR_NAME" >> $GITHUB_ENV
+          echo "ACR_LOGIN_SERVER=${ACR_NAME}.azurecr.io" >> $GITHUB_ENV
+          echo "✓ Using ACR: ${ACR_NAME}.azurecr.io"
+
+      - name: ACR Login
+        run: |
+          ACR_TOKEN=$(az acr login --name "$ACR_NAME" --expose-token --output tsv --query accessToken)
+          docker login "$ACR_LOGIN_SERVER" \
+            --username 00000000-0000-0000-0000-000000000000 \
+            --password "$ACR_TOKEN"
+          echo "✓ ACR login successful"
+
+      - name: Build and Push Docker image
+        run: |
+          IMAGE_TAG="${{ gitea.sha }}"
+          IMAGE_FULL="${ACR_LOGIN_SERVER}/reno-test-14:${IMAGE_TAG}"
+          IMAGE_LATEST="${ACR_LOGIN_SERVER}/reno-test-14:latest"
+          docker build -t "$IMAGE_FULL" -t "$IMAGE_LATEST" .
+          docker push "$IMAGE_FULL"
+          docker push "$IMAGE_LATEST"
+          echo "IMAGE_FULL=$IMAGE_FULL" >> $GITHUB_ENV
+          echo "✓ Pushed: $IMAGE_FULL"
+
+      - name: Build Summary
+        run: |
+          echo "### ✅ Build Successful" >> $GITHUB_STEP_SUMMARY
+          echo "| | |" >> $GITHUB_STEP_SUMMARY
+          echo "|---|---|" >> $GITHUB_STEP_SUMMARY
+          echo "| **Service** | reno-test-14 |" >> $GITHUB_STEP_SUMMARY
+          echo "| **Commit** | ${{ gitea.sha }} |" >> $GITHUB_STEP_SUMMARY
+          echo "| **Image** | $IMAGE_FULL |" >> $GITHUB_STEP_SUMMARY