diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
deleted file mode 100644
index e2aed4d..0000000
--- a/.github/workflows/release.yml
+++ /dev/null
@@ -1,42 +0,0 @@
-name: Release version
-
-"on":
-  push:
-    tags:
-      - '*'
-
-jobs:
-  release:
-
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v1
-      - name: Checkout submodules
-        shell: bash
-        run: |
-          auth_header="$(git config --local --get http.https://github.com/.extraheader)"
-          git submodule sync --recursive
-          git -c "http.extraheader=$auth_header" -c protocol.version=2 submodule update --init --force --recursive
-          git -c "http.extraheader=$auth_header" -c protocol.version=2 submodule update --remote --recursive
-      - name: Setup Python
-        uses: actions/setup-python@v1
-        with:
-          python-version: 3.8
-      - name: Install pip
-        run: |
-          python -m pip install --upgrade pip
-          pip install ansible tox tox-ansible
-      - name: Run final lint check
-        run: |
-          tox -e lint_all
-      - name: Create release artifacts
-        run: |
-          ansible-galaxy collection build
-          ansible-galaxy collection publish *.tar.gz --api-key ${{ secrets.GALAXY_API_KEY }}
-      - name: Release artifacts to Git Hub
-        uses: ncipollo/release-action@v1
-        with:
-          artifacts: ./oasis_roles-system*.tar.gz
-          allowUpdates: true
-          name: Rlease ${{ github.ref }}
-          token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/tox.yml b/.github/workflows/tox.yml
index 1aad2db..fedce06 100644
--- a/.github/workflows/tox.yml
+++ b/.github/workflows/tox.yml
@@ -1,11 +1,7 @@
 name: Test with Ansible
 
 on:
-  push:
-    branches:
-      - '*'
-    tags-ignore:
-      - '*'  # A build will already happen for the commit, don't also build the tag
+  push: {}
   pull_request: {}
   schedule:
     - cron: '12 0 * * *'
@@ -13,44 +9,13 @@ on:
 env:
   TOX_ANSIBLE_DRIVER: docker
   ANSIBLE_COLLECTIONS_PATHS: ~/.ansible/:~/work/
-  COLLECTION_NAMESPACE: oasis_roles
-  COLLECTION: system
+  checkout_path: ansible_collections/oasis_roles/system
 
 jobs:
-  lint:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v2
-      - name: Checkout submodules
-        shell: bash
-        run: |
-          auth_header="$(git config --local --get http.https://github.com/.extraheader)"
-          git submodule sync --recursive
-          git -c "http.extraheader=$auth_header" -c protocol.version=2 submodule update --init --force --recursive
-          git -c "http.extraheader=$auth_header" -c protocol.version=2 submodule update --remote --recursive
-      - name: Setup pip cache
-        uses: actions/cache@v1
-        with:
-          path: ~/.cache/pip
-          key: pip-modules
-      - name: Set up Python 3.8
-        uses: actions/setup-python@v1
-        with:
-          python-version: 3.8
-      - name: Install dependencies
-        shell: bash
-        run: |
-          set -e
-          python -m pip install --upgrade pip
-          pip install tox tox-ansible
-      - name: Run lint
-        shell: bash
-        run: tox -e lint_all
-
   build:
-    needs: lint
     runs-on: ubuntu-latest
     strategy:
+      fail-fast: false
       matrix:
         role:
           - cockpit
@@ -73,13 +38,13 @@ jobs:
           - upload_files
     steps:
       - uses: actions/checkout@v2
-      - name: Checkout submodules
-        shell: bash
+        with:
+          submodules: 'recursive'
+          path: ${{ env.checkout_path }}
+      - name: update submodules to latest
         run: |
-          auth_header="$(git config --local --get http.https://github.com/.extraheader)"
-          git submodule sync --recursive
-          git -c "http.extraheader=$auth_header" -c protocol.version=2 submodule update --init --force --recursive
-          git -c "http.extraheader=$auth_header" -c protocol.version=2 submodule update --remote --recursive
+          cd "${{ env.checkout_path }}"
+          git submodule update --remote --recursive
       - name: Setup pip cache
         uses: actions/cache@v1
         with:
@@ -91,15 +56,43 @@ jobs:
           python-version: 3.8
       - name: Install dependencies
         run: |
+          set -ex
           python -m pip install --upgrade pip
           pip install tox tox-ansible
       - name: Test with tox
         run: |
-          cd ..
-          dest="${HOME}/work/ansible_collections/${COLLECTION_NAMESPACE}"
-          mkdir -p "${dest}"
-          mv "$(basename "${GITHUB_REPOSITORY}")" "${dest}/${COLLECTION}"
-          # post actions fail if this doesn't exist
-          mkdir -p "$(basename "${GITHUB_REPOSITORY}")"
-          cd "${dest}/${COLLECTION}"
+          set -ex
+          # There is some magic in the "mv" command that makes ansible-galaxy work
+          # I haven't found any logic for it, but if you don't do this mv, then
+          # the dependency step in molecule when run from tox will fail
+          mv ansible_collections ~/work/
+          cd ~/work/${{ env.checkout_path }}
           tox --ansible-role ${{ matrix.role }}
+
+  release:
+    needs: build  # Only release if the build is good
+    if: startsWith(github.ref, 'refs/tags/')  # Only release if there is a tag that's been pushed to the repo
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+        with:
+          submodules: 'recursive'
+      - name: Setup Python
+        uses: actions/setup-python@v1
+        with:
+          python-version: 3.8
+      - name: Install pip
+        run: |
+          python -m pip install --upgrade pip
+          pip install ansible
+      - name: Create release artifacts
+        run: |
+          ansible-galaxy collection build
+          ansible-galaxy collection publish *.tar.gz --api-key ${{ secrets.GALAXY_API_KEY }}
+      - name: Release artifacts to Git Hub
+        uses: ncipollo/release-action@v1
+        with:
+          artifacts: ./oasis_roles-system*.tar.gz
+          allowUpdates: true
+          name: Rlease ${{ github.ref }}
+          token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/tox.ini b/tox.ini
index c384751..53087fb 100644
--- a/tox.ini
+++ b/tox.ini
@@ -12,10 +12,6 @@ molecule_opts =
 parallel_show_output = true
 usedevelop = false
 skip_install = true
-passenv =
-  TERM
-  HOME
-  OS_*
-  OASIS_*
+passenv = *
 setenv =
   ANSIBLE_COLLECTIONS_PATHS={toxinidir}/../../../