Try this now

.gitlab-ci.yml

 ---
+workflow:
+  rules:
+    # Do no allow manually triggered pipelines to prevent duplicates!
+    # Instead rerun the pipeline created with the last push
+    - if: $CI_PIPELINE_SOURCE != "push"
+      when: never
+    # Only execute when using a valid version tag like v1.0 or v1.0.2
+    # - if: $CI_COMMIT_TAG =~ /^v\d+\.\d+\.?\d*$/
+    #- if: $CI_COMMIT_BRANCH == 'main'
+
 variables:
   S3_ENDPOINT: "https://s3.embl.de"
   S3_BUCKET: "annelids"
+
 stages:
+  - download_from_s3
   - upload_to_s3
+  - build_container
   - deploy_to_cluster
   - clean_up_on_failure
+
 s3_access_test:
   image: minio/mc
-  stage: upload_to_s3
+  stage: download_from_s3
   before_script:
     - mc alias set genomes $S3_ENDPOINT $S3_ACCESS_KEY $S3_SECRET_KEY
   script:
     - mc ls genomes/$S3_BUCKET
+    - cd image
+
+build_nginx_with_jbrowse_config_file:
+  image: gcr.io/kaniko-project/executor:debug-v0.21.0
+  stage: build_container
+  before_script:
+    - echo "{\"auths\":{\"$CI_REGISTRY\":{\"username\":\"$CI_REGISTRY_USER\",\"password\":\"$CI_REGISTRY_PASSWORD\"}}}" > /kaniko/.docker/config.json
+  script:
+    - /kaniko/executor --cache=true --context $CI_PROJECT_DIR/image --dockerfile $CI_PROJECT_DIR/image/Dockerfile --destination $CI_REGISTRY_IMAGE:prod-$CI_COMMIT_SHORT_SHA
+
 cluster_access_test:
   image: dtzar/helm-kubectl:3.8.2
   stage: deploy_to_cluster
@@ -22,6 +46,7 @@ cluster_access_test:
     - export KUBECONFIG=/tmp/kubeconf
   script:
     - kubectl config current-context
+
 kustomize_build_apply:
   image: dtzar/helm-kubectl:3.8.2
   stage: deploy_to_cluster
@@ -33,6 +58,7 @@ kustomize_build_apply:
     - kubectl -n $NS wait --for=condition=available --timeout=60s deploy/jbrowse2
   dependencies:
     - cluster_access_test
+
 clean_up_k8s_deployment:
   image: dtzar/helm-kubectl:3.8.2
   stage: clean_up_on_failure