diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index f5c6ed2..5afa128 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -9,20 +9,27 @@
 # never published to a store. The server listens on 127.0.0.1:8787 unless
 # given -addr.
 #
-# A pull request that changes this file builds everything and publishes
-# nothing.
+# It is also the repository's CI: every pull request and every push to main
+# builds everything and publishes nothing, so a change that breaks a build
+# or a unit test fails before it is merged rather than at the next tag. A
+# failure on main opens an issue (failure-issue.yml).
 name: Release
 
 on:
   push:
+    branches: [main]
     tags: ['v*']
   pull_request:
-    paths: ['.github/workflows/release.yml']
   workflow_dispatch:
 
 permissions:
   contents: read
 
+# A pull request's earlier run is superseded by its newest commit.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   android:
     runs-on: ubuntu-latest
@@ -71,7 +78,7 @@ jobs:
         with:
           path: dist
           merge-multiple: true
-      - run: sha256sum * > SHA256SUMS
+      - run: sha256sum -- * > SHA256SUMS
         working-directory: dist
       - run: gh release create "$GITHUB_REF_NAME" dist/* --repo "$GITHUB_REPOSITORY" --title "Morpho Match $GITHUB_REF_NAME" --generate-notes
         env: