Only run publish job in CI on tag pushes

Author: marteinn

.github/workflows/main.yml

@@ -81,6 +81,7 @@ jobs:
           isort . --check-only
 
   publish:
+    if: startsWith(github.ref, 'refs/tags/')
     runs-on: ubuntu-latest
     needs: [test, lint-black, lint-isort]
     environment: pypi

CHANGELOG.md

@@ -20,6 +20,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Restrict GitHub Actions push trigger to main branches and release tags (@marteinn)
 - Pin isort to specific version in CI (@marteinn)
 - Fix broken jQuery selector in PolyfillColorInputWidget caused by missing # prefix after XSS fix (@marteinn)
+- Only run publish job in CI on tag pushes (@marteinn)
 
 ### Removed
 - Drop support for EOL python 3.9 (@marteinn)