title: How to conditionally run Github workflow action only for tags made on specific branch?
body: <p>I am using a couple different Github workflows including one that should only run on official releases.  Inside the <code>.github/workflows/release.yml</code> is this <code>on</code> condition:</p>
  <pre><code>on:
    push:
      tags:
        - 'v*'
  </code></pre>
  <p>However, this can still run if someone on our team accidentally (or purposely) pushes a tag from the <code>develop</code> branch.  Ideally, we would want to lock this down so that the tag MUST be on the <code>main</code> branch (since that is protected), and maybe even further, it would be nice if we could ensure that the tags are only referencing the specific merge commit relating to the corresponding release.  For example, if I run</p>
  <pre><code>git branch --contains tags/v1.2.3
  </code></pre>
  <p>this would normally output the <code>main</code> branch where I made the tag.  Can I add a condition to the github workflow to check the output of that?</p>
  <p>Looking at the <a href="https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions#onpushpull_requestbranchestags" rel="noreferrer">Github action documentation</a> it is not clear if multiple conditions are evaluated using a logical AND or a logical OR.</p>