Enable this post-build deploy workflow?

Situation

The DevOps team wants to separate build and deploy into two workflows for better audit trails. The deploy workflow should run automatically after a successful build.

Environment

The Build workflow compiles the application and uploads a build artifact. The deploy workflow runs in the default branch context with production AWS credentials. PR builds also produce artifacts.

Select suspicious lines in the terminal to flag them before submitting your verdict.

pending review

name: Deploy After Build
on:
  workflow_run:
    workflows: [Build]
    types: [completed]
    branches: [main]
jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/download-artifact@v4
        with:
          name: build-output
          run-id: ${{ github.event.workflow_run.id }}
      - name: Deploy
        run: tar -xzf build-output.tar.gz && ./deploy.sh