fix: skip tag-annotation fetch step on workflow_dispatch

The 'Get Tag Annotations' step runs:
  git fetch -f origin ${{ github.ref }}:${{ github.ref }}

When the workflow is triggered manually (workflow_dispatch), github.ref
resolves to refs/heads/main. Git refuses to fetch into a branch that is
already checked out, exiting with code 128.

The fetch is only meaningful for tag-triggered runs (it retrieves
annotated tag metadata that the shallow checkout misses). Add an
'if: startsWith(github.ref, "refs/tags/")' condition so the step is
skipped entirely on manual dispatch triggers.

Author: remcovm

.github/workflows/publish.yml

@@ -24,7 +24,10 @@ jobs:
         fetch-tags: true
 
     # See https://github.com/actions/checkout/issues/290
+    # Only needed for tag-triggered runs; fetching a branch ref into the
+    # checked-out branch causes git to refuse with exit code 128.
     - name: "Get Tag Annotations"
+      if: startsWith(github.ref, 'refs/tags/')
       run: git fetch -f origin ${{ github.ref }}:${{ github.ref }}
 
     - name: "Setup"