diff --git a/.github/workflows/CD-publish-app-image.yml b/.github/workflows/CD-publish-app-image.yml
index 9633d2592f..9239d6e3e5 100644
--- a/.github/workflows/CD-publish-app-image.yml
+++ b/.github/workflows/CD-publish-app-image.yml
@@ -3,7 +3,7 @@ name: "Publish Application Image"
 on:
   push:
     branches:
-      - image
+      - app-image
       - fake-image
     paths-ignore:
       - '**.md'
@@ -35,7 +35,7 @@ jobs:
           fi 
 
       - name: Check user permission
-        if: github.event_name == "workflow_dispatch"
+        if: github.event_name == 'workflow_dispatch'
         id: check
         uses: scherermichael-oss/action-has-permission@master
         with:
@@ -44,7 +44,7 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Exit if user doesn't have write permission
-        if: github.event_name == "workflow_dispatch"
+        if: github.event_name == 'workflow_dispatch'
         run: |
           if [ "${{ steps.check.outputs.has-permission }}" = "false" ]; then
             echo "Only users with write permission are allowed to execute this workflow."
@@ -65,12 +65,6 @@ jobs:
           node-version: '16'
           registry-url: 'https://registry.npmjs.org'
           scope: '@sjcrh'
-      - run: npm ci
-
-      - name: Run version bump
-        run: |
-          ./build/ci-version-update.sh $VERTYPE -w
-          # !!! --- merge back to master --- !!!
 
       - name: Login to GitHub Container Registry
         run: |
@@ -79,16 +73,14 @@ jobs:
           CR_PAT: ${{ secrets.PAT }}
 
       - name: Build and Publish Docker Images
-        run: 
-          sleep 90;
-          cd container;
-          ./build2.sh -r "ghcr.io/stjude/" server;
-          TAG="$(node -p "require('./server/package.json').version")";
-          HASH="$(git rev-parse --short HEAD)";
-          docker push ghcr.io/stjude/ppserver:$TAG-$HASH;
-          docker push ghcr.io/stjude/ppserver:latest;
+        run: |
+          BRANCH="$(git rev-parse --abbrev-ref HEAD)"
+          MODE="-w"
+          if [[ "$BRANCH" != "app-image" && "$BRANCH" != "release-chain" && "$BRANCH" != "master" && ${{ github.event_name }} != "workflow_dispatch" ]]; then
+            MODE=""
+          fi
+
+          cd container
+          npm install glob
+          ./release.sh "$MODE"
 
-          ./build2.sh -r "ghcr.io/stjude/" full;
-          TAG="$(node -p "require('./full/package.json').version")";
-          docker push ghcr.io/stjude/ppfull:$TAG-$HASH;
-          docker push ghcr.io/stjude/ppfull:latest;
diff --git a/.github/workflows/CD-publish-deps-image.yml b/.github/workflows/CD-publish-deps-image.yml
index c97f1fb675..7cffcc871c 100644
--- a/.github/workflows/CD-publish-deps-image.yml
+++ b/.github/workflows/CD-publish-deps-image.yml
@@ -59,11 +59,11 @@ jobs:
 
       - name: Build image
         run: |
-          cd container/deps
-          ./version.sh -c
+          cd container
+          ./version.sh deps
 
           BRANCH=$(git rev-parse --abbrev-ref HEAD)
-          if [[ "$BRANCH" != "deps-image" && "${{ github.event_name }}" != "workflow_dispatch" ]]; then 
+          if [[ "$BRANCH" != "publish-image" && "$BRANCH" != "release-chain" && "$BRANCH" != "master" && ${{ github.event_name }} != "workflow_dispatch" ]]; then
             echo "skipping build and publishing"
           else
             ./build.sh -m "ghcr.io/stjude/"
diff --git a/container/build2.sh b/container/build2.sh
index 32a425fd62..c01c4dec2a 100755
--- a/container/build2.sh
+++ b/container/build2.sh
@@ -127,5 +127,5 @@ docker buildx build . \
 # Clean up
 #############
 
-git restore server/package.json
-git restore full/package.json
+# git restore server/package.json
+# git restore full/package.json
diff --git a/container/deps/app-full.js b/container/deps/app-full.js
index 1d639f0dba..5f349f7b22 100755
--- a/container/deps/app-full.js
+++ b/container/deps/app-full.js
@@ -6,7 +6,7 @@ const serverconfigFile = path.join(__dirname, './serverconfig.json')
 if (!fs.existsSync(serverconfigFile)) {
 	throw `missing serverconfig.json: did you forget to mount?`
 }
-
+console.log('test')
 const serverconfig = require(serverconfigFile)
 if (!serverconfig.genomes) {
 	serverconfig.genomes = [
diff --git a/container/release.sh b/container/release.sh
new file mode 100755
index 0000000000..e3deb2fb2a
--- /dev/null
+++ b/container/release.sh
@@ -0,0 +1,36 @@
+#!/bin/bash
+
+# call from the container dir
+# ./publish.sh [-w]
+# -w  option to commit changes
+
+MODE="$1"
+HASH="$(git rev-parse --short HEAD)"
+
+./version.sh server
+if [[ "$MODE" == "-w" ]]; then
+  ./build2.sh -r "ghcr.io/stjude/" server
+  TAG="$(node -p "require('./server/package.json').version")"  
+  docker push ghcr.io/stjude/ppserver:$TAG-$HASH
+  docker push ghcr.io/stjude/ppserver:latest
+fi
+
+./version.sh full
+if [[ "$MODE" == "-w" ]]; then
+  ./build2.sh -r "ghcr.io/stjude/" full
+  TAG="$(node -p "require('./full/package.json').version")"
+  docker push ghcr.io/stjude/ppfull:$TAG-$HASH
+  docker push ghcr.io/stjude/ppfull:latest
+fi
+
+if [[ "$MODE" == "-w" ]]; then
+  echo "committing version changes"
+  git config --global user.email "PPTeam@STJUDE.ORG"
+  git config --global user.name "PPTeam CI"
+  git add --all
+  ROOTPKGVER=$(node -p "require('../package.json').version")
+  SERVERPKGVER=$(node -p "require('../server/package.json').version")
+  FRONTPKGVER=$(node -p "require('../front/package.json').version")
+  git commit -m "image v$ROOTPKGVER server=$SERVERPKGVER front=$FRONTPKGVER"
+  git push
+fi
\ No newline at end of file
diff --git a/container/version.sh b/container/version.sh
new file mode 100755
index 0000000000..7eb4df5186
--- /dev/null
+++ b/container/version.sh
@@ -0,0 +1,49 @@
+#!/bin/bash
+
+set -euxo pipefail
+
+MODE=""
+if (( $# == 0 )); then
+	echo "Missing subdir argument"
+	echo "Usage: call from within the container dir
+	
+	./version.sh [subdir=deps|server|full] [-w]
+  
+  subdir  required, any of the container subdirectory that has a dockerfile
+  -w       option to commit changes
+	"
+	exit 1
+fi
+
+SUBDIR=$1
+MODE=""
+if (( $# == 2 )); then
+	MODE="$2"
+fi
+
+cd ..
+# container image builds will use published packages, so no need to the excluded workspaces here
+UPDATED=$(./build/bump.js $MODE -x=rust -x=augen -x=server -x=client -x=front)
+echo "UPDATED=[$UPDATED]"
+cd container/$SUBDIR
+
+DEPS="dependencies.@sjcrh/proteinpaint-"
+if [[ "$(grep containerDeps ./package.json)" != "" ]]; then
+	DEPS=containerDeps.
+fi
+
+ROOTPKGVER=$(node -p "require('../../package.json').version")
+echo "setting $SUBDIR package.version='$ROOTPKGVER'"
+npm pkg set version=$ROOTPKGVER
+
+SERVERPKGVER=$(node -p "require('../../server/package.json').version")
+echo "setting $SUBDIR package.${DEPS}server='$SERVERPKGVER'"
+npm pkg set "${DEPS}server"=$SERVERPKGVER
+
+if [[ "$SUBDIR" == "full" ]]; then
+	FRONTPKGVER=$(node -p "require('../../front/package.json').version")
+	echo "setting $SUBDIR package.${DEPS}full='$SERVERPKGVER'"
+	npm pkg set "${DEPS}front"=$FRONTPKGVER
+fi
+
+cd ..