Github Action workflow_run only on push to main branch

I have a CI workflow that runs on PR and PUSH to main branch.

---
name: CI

on:
  push:
    branches:
      - main
  pull_request:
    types: [opened, synchronize, reopened]

I have another workflow I'd like to only run after CI is complete and conclusion is success but only when it's pushed to main branch.

---
name: Build

on:
  workflow_run:
    workflows: ["CI"]
    types:
      - completed
jobs:
  build:
    name: Build
    runs-on: self-hosted
    if: ${{ github.event.workflow_run.conclusion == 'success' }}

It runs on both PR and push to main. How do I get the Build workflow to only run on push to main?

• You can filter on the branch in the Build workflow (see https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#limiting-your-workflow-to-run-based-on-branches)
• You can also interrogate the event payload to determine what event triggered the originating workflow (github.event.workflow_run.event, see https://docs.github.com/en/webhooks/webhook-events-and-payloads#workflow_run)

on:
  workflow_run:
    workflows: ["CI"]
    types:
      - completed
    branches:
      - main
jobs:
  build:
    name: Build
    runs-on: self-hosted
    if: ${{ github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event == 'push' }}