Only run publish steps on tags

Author: ngoldbaum

.github/workflows/ci.yml

@@ -108,6 +108,7 @@ jobs:
   publish:
     runs-on: ubuntu-latest
     needs: [lint, test, package-sdist, package-wheel]
+    if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/')
     environment: publish
     permissions:
       # Required by Trusted Publishing
@@ -131,5 +132,4 @@ jobs:
           pattern: wheels-ubuntu-latest-*
           path: dist/
       - name: Publish to PyPI
-        if: github.event_name == 'push' && startsWith(github.event.ref, 'refs/tags/')
         uses: pypa/gh-action-pypi-publish@release/v1