update workflow; prepare for HTTPS