fix(publish): add check-snapshot/check-tag gates to fix release routing

Inserts two lightweight gate jobs between `report` and the publish/release
jobs to fix incorrect routing:

- `github-snapshot` and `publish-snapshot` were firing on any
  workflow_dispatch, including dispatches from a tag ref.
- `publish-release` condition used `||` so it fired on any dispatch with
  release_to_maven_central=true even from a branch (where github-release
  was skipped, causing publish-release to also skip silently).

The two new gate jobs (`check-snapshot`, `check-tag`) succeed only on the
correct ref type. Downstream jobs gate on `needs.<gate>.result == 'success'`
so they automatically skip when the gate is skipped.

Author: bernardladenthin

.github/workflows/publish.yml

@@ -620,12 +620,30 @@ jobs:
           files: target/site/jacoco/jacoco.xml
         continue-on-error: true
 
-  github-snapshot:
-    name: Update Snapshot Pre-release on GitHub
+  check-snapshot:
+    name: Check: main branch / SNAPSHOT
     needs: [report]
+    runs-on: ubuntu-latest
     if: >-
       (github.event_name == 'push' && github.ref == 'refs/heads/main') ||
-      github.event_name == 'workflow_dispatch'
+      (github.event_name == 'workflow_dispatch' && !startsWith(github.ref, 'refs/tags/v'))
+    steps:
+      - name: Confirm snapshot ref
+        run: echo "Confirmed on snapshot ref ${{ github.ref }}"
+
+  check-tag:
+    name: Check: v* tag
+    needs: [report]
+    runs-on: ubuntu-latest
+    if: startsWith(github.ref, 'refs/tags/v')
+    steps:
+      - name: Confirm tag ref
+        run: echo "Confirmed on tag ${{ github.ref }}"
+
+  github-snapshot:
+    name: Update Snapshot Pre-release on GitHub
+    needs: [check-snapshot]
+    if: needs.check-snapshot.result == 'success'
     runs-on: ubuntu-latest
     permissions:
       contents: write
@@ -650,10 +668,8 @@ jobs:
 
   publish-snapshot:
     name: Publish Snapshot to Central
-    needs: [github-snapshot]
-    if: >-
-      (github.event_name == 'push' && github.ref == 'refs/heads/main') ||
-      github.event_name == 'workflow_dispatch'
+    needs: [github-snapshot, check-snapshot]
+    if: needs.check-snapshot.result == 'success'
     runs-on: ubuntu-latest
     environment: maven-central
     steps:
@@ -685,8 +701,8 @@ jobs:
 
   github-release:
     name: Attach Binaries to GitHub Release
-    needs: [report]
-    if: startsWith(github.ref, 'refs/tags/v')
+    needs: [check-tag]
+    if: needs.check-tag.result == 'success'
     runs-on: ubuntu-latest
     permissions:
       contents: write
@@ -702,8 +718,8 @@ jobs:
 
   publish-release:
     name: Publish Release to Central
-    if: startsWith(github.ref, 'refs/tags/v') || github.event.inputs.release_to_maven_central == 'true'
-    needs: [github-release, crosscompile-linux-x86_64-cuda]
+    if: needs.check-tag.result == 'success' && github.event.inputs.release_to_maven_central == 'true'
+    needs: [github-release, check-tag, crosscompile-linux-x86_64-cuda]
     runs-on: ubuntu-latest
     environment: maven-central
     steps: