ci: Add extra check for github-tag-action

As the comment says, this isn't strictly necessary with the
configuration we have here, as opposed to the ehrQL repository where the
upgrade to github-tag-action caused some confusing behaviour.

The value is as a safeguard, and documenting the behaviour for someone
editing the workflow in future.

.github/workflows/build_and_publish.yaml

@@ -17,6 +17,13 @@ jobs:
       - name: Bump version and push tag
         id: tag
         uses: mathieudutour/[email protected]
+        # As this workflow is currently written,
+        # this is a redundant check: the workflow should only ever run on push to main.
+        # But it is an extra safeguard and reminder of the behaviour of github-tag-action.
+        # Pull requests can end up being tagged by github-tag-action,
+        # which is probably undesirable and very confusing to work out what's happening.
+        # See https://github.com/opensafely-core/ehrql/commit/3e55492e9c1b537fb5057f19f11f53a713fbae46
+        if: github.ref == 'refs/heads/main' && github.event_name != 'pull_request'
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           default_bump: false