diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 9700373..f46a74b 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -17,15 +17,16 @@ jobs:
         run: make test
       - name: Build image
         run: make build_image
-      - name: Get Branch
+      - name: Get Branch # Needed to evaluate env.BRANCH.
+        if: ${{ startsWith(github.ref, 'refs/tags/v') && github.event_name == 'push' }} # Otherwise will fail on pull requests.
         run: |
           raw=$(git branch -r --contains ${{ github.ref }})
           branch=${raw##*/}
           echo "BRANCH=$branch" >> $GITHUB_ENV
       - name: Login to Docker Hub
-        if: ${{ startsWith(github.ref, 'refs/tags/v') && github.event_name == 'push' && env.BRANCH == 'master' }} # Only publish for tagged commits pushed to master.
+        if: ${{ startsWith(github.ref, 'refs/tags/v') && github.event_name == 'push' && env.BRANCH == 'master' }} # Only login for tagged commits pushed to master.
         uses: docker/login-action@v1
-        with:
+        with: # Secrets are not exposed to pull request contexts.
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
       - name: Publish image