If you could use job conditions to run a certain step only on a tag you could use the needs keyword to specify dependencies. Without this, these steps need to be ran again in the tag-only workflow.
jobs:
publish:
if: github.tag # <- this doesn't work
needs: [test, build]
Workaround: create a separate workflow.
For example if you want to match a versioning format on tags you can do:
on:
push:
tags:
- 'v*'
But you cannot do:
on:
push:
tags:
- '/^v[0-9]\.[0-9]\.[0-9]$/'
This would allow for organizing workflows. For example the workflow publish would depend on the workflow verify, both of which have their set of jobs. You're left with either a single workflow (uncomfortably named something generic like CI) within which jobs can have the proper dependencies, or multiple workflows where certain steps are duplicated (e.g. you always want to run tests before publishing).