diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index a8638f8..103caa9 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -19,6 +19,8 @@ on:
 
 # A workflow run is made up of one or more jobs that can run sequentially or in parallel
 jobs:
+   permissions:
+      contents: write
   # This workflow contains a single job called "build"
   build:
     # The type of runner that the job will run on
@@ -32,7 +34,6 @@ jobs:
       # Runs a set of commands using the runners shell
       - name: Init scripts
         run: |
-          $PSVersionTable | Format-List | Out-Host
           [void](New-Item -Type Directory ./src -ErrorAction Stop)
           Copy-Item ./build.ps1 ./src -ErrorAction Stop
           Remove-Item ./build.ps1 -ErrorAction Stop
@@ -42,4 +43,3 @@ jobs:
       - name: Cleanup
         run: |
           Remove-Item -Recurse -Force .\src
-          tree /f .
diff --git a/build.ps1 b/build.ps1
index fbee256..85ac8d2 100644
--- a/build.ps1
+++ b/build.ps1
@@ -4,10 +4,14 @@ $BULMA_URL = "https://api.github.com/repos/jgthms/bulma"
 
 # get releases and extract needed information
 $BulmaReleases = Invoke-RestMethod -FollowRelLink -Uri "$BULMA_URL/releases?per_page=100" | %{$_}| ForEach-Object {
-   [PSCustomObject]@{
-      version = [version]$_.tag_name
-      archive = [string]$_.assets.name
-      download = [string]$_.assets.browser_download_url
+   if ($_.tag_name) {
+      [PSCustomObject]@{
+         version = [version]$_.tag_name
+         archive = [string]$_.assets.name
+         download = [string]$_.assets.browser_download_url
+      }
+   } else {
+      Write-Warning "found untagged release for $($_.assets.name)"
    }
 } | Sort-Object -Property version
 $tags = git tag
@@ -17,20 +21,37 @@ foreach ($release in $BulmaReleases) {
       continue
    }
    # download
+   Write-Output "new release   : $release"
    $archive = Join-Path -Path $TEMPDIR -ChildPath $release.archive
-   if (Test-Path -Path $archive) {
-      Write-Output "is downloaded : $release"
-      continue
-   } else {
-      Write-Output "new release   : $release"
-      Invoke-WebRequest -Uri $release.download -OutFile $archive
-      break
-   }
+   Invoke-WebRequest -Uri $release.download -OutFile $archive
+   $bulmaFolder = (Get-Item $archive).Basename
+   Remove-Item -Recurse .\assets -ErrorAction SilentlyContinue
+   if (Test-Path .\assets) { throw ".\assets should not exist"}
+   if (Test-Path .\build.ps1) { throw ".\build.ps1 should not exist"}
+   git checkout -b $bulmaFolder
+   git status
+   [void](New-Item -Type Directory ./assets -ErrorAction Stop)
+   if (-Not (Test-Path .\assets -PathType Container)) { throw ".\assets should exist"}
+   Expand-Archive -LiteralPath $archive -DestinationPath .\assets
+   if (Test-Path .\assets\__MACOSX) { Remove-Item .\assets\__MACOSX -ErrorAction SilentlyContinue -Recurse }
+   Rename-Item .\assets\$bulmaFolder "bulma"
+   dir .
+   dir .\assets
+   if (-Not (Test-Path ./assets/bulma -PathType Container)) { throw "missing ./assets/bulma folder"}
+   git add assets\bulma
+   git config --local core.autocrlf "true"
+   git config --local user.name "irkode"
+   git config --global user.email "irkode@rikode.de"
+   Write-Output "committing..."
+   git commit -m "add $bulmaFolder"
+   Write-Output "tagging..."
+   git tag --annotate $release.version -m "release Bulma 4 Hugo v$($release.version)"
+   Write-Output "remove branch..."
+   git checkout main
+   git branch -D $bulmaFolder
+   git log --oneline -n 5
+   git tag
+   git branch
+   git push
+   break
 }
-$bulmaFolder = (Get-Item $archive).Basename
-[void](Remove-Item -Recurse .\assets -ErrorAction SilentlyContinue)
-if ( Test-Path .\assets) { throw ".\assets should not exist"}
-Expand-Archive -LiteralPath $archive -DestinationPath .
-Rename-Item $bulmaFolder "assets"
-[void](Remove-Item __MACOSX -ErrorAction SilentlyContinue -Recurse)
-git status